CVE-2021-39939
Description
An uncontrolled resource consumption vulnerability in GitLab Runner affecting all versions starting from 13.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker triggering a job with a specially crafted docker image to exhaust resources on runner manager
Summary dbcve.org
GitLab Runner versions prior to 14.3.6, 14.4.4, and 14.5.2 contain an uncontrolled resource consumption vulnerability where a specially crafted docker image in a job can exhaust resources on the runner manager, potentially causing denial of service.
Mitigation
Upgrade GitLab Runner to version 14.3.6, 14.4.4, 14.5.2 or later. Alternatively, implement job resource limits and timeout configurations in the runner's config.toml to constrain job resource usage.