CVE-2023-0921
Allocation of Resources Without Limits or Throttling in GitLab
Summary
Allocation of Resources Without Limits or Throttling in GitLab
Original description
The description as published by the source.
A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.
Affected packages
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"15.10.8"},{"introduced":"15.11.0"},{"fixed":"15.11.7"},{"introduced":"16.0.0"},{"fixed":"16.0.2"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- report gitlab.com
- web gitlab.com
- web hackerone.com