CVE-2021-39940
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab Maven Package registry is vulnerable to a regular expression denial of service when a specifically crafted string is sent.
Summary dbcve.org
GitLab's Maven Package Registry contains a regular expression denial of service (ReDoS) vulnerability. An attacker can send a specifically crafted string to the Maven registry endpoint that causes the regex engine to take an extremely long time to process, leading to service degradation or unavailability.
Mitigation
Upgrade GitLab to version 14.3.7, 14.4.5, 14.5.3, or later. Alternatively, if immediate patching is not feasible, consider restricting access to the Maven Package Registry or implementing rate limiting on the affected endpoint.