CVE-2022-4131
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in how the application parses user agents.
Summary dbcve.org
This is a ReDoS (Regular Expression Denial of Service) vulnerability in GitLab's user agent parsing logic. An attacker can send specially crafted user agent strings that cause the regex engine to consume excessive CPU resources, leading to denial of service.
Mitigation
Upgrade GitLab to version 15.5.7, 15.6.4, 15.7.2 or later. Consider implementing rate limiting or WAF rules as an interim mitigation to limit requests with abnormally long or complex user agent strings.