CVE-2020-26414
Description
An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string.
Summary dbcve.org
This is a ReDoS (Regular Expression Denial of Service) vulnerability in GitLab's package name validation. The regex used to validate package names exhibits quadratic backtracking behavior, meaning execution time grows with the square of input length. An attacker can provide a specially crafted long input string to cause excessive CPU consumption and potentially crash the service.
Mitigation
Upgrade GitLab to the patched version. As a temporary measure, implement input length restrictions or rate limiting on package name submissions to limit exposure to this ReDoS vector.