CVE-2022-3613
Description
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A crafted Prometheus Server query can cause high resource consumption and may lead to Denial of Service.
Summary dbcve.org
A specially crafted Prometheus Server query in GitLab CE/EE versions prior to 15.5.7, 15.6.4, and 15.7.2 triggers excessive resource consumption, potentially causing denial of service. The vulnerability is exploitable remotely without authentication via malicious query input to the Prometheus integration.
Mitigation
Upgrade GitLab to version 15.5.7, 15.6.4, 15.7.2 or later. If immediate upgrade is not feasible, consider disabling or restricting the Prometheus integration until the patch can be applied.