CVE-2022-3411
Description
A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.
Summary dbcve.org
This is a denial-of-service vulnerability in GitLab's GraphQL API where the issue description field lacks length validation. An authenticated attacker can create an issue with an excessively large description, and when this description is repeatedly requested (e.g., via API calls), it saturates CPU usage through resource exhaustion.
Mitigation
Upgrade to GitLab 15.6.7, 15.7.6, or 15.8.1 or later. As a compensating control, implement rate limiting on GraphQL endpoints and monitor for unusual patterns of issue creation or retrieval.