CVE-2023-1072
Description
An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion attack due to improper filtering for number of requests to read commits details.
Summary dbcve.org
GitLab versions 9.0 through 15.9.1 contain an improper input validation vulnerability in the commit details reading functionality. An attacker can trigger a resource depletion (denial of service) attack by sending excessive requests to read commit information without proper rate limiting or filtering on the number of requests.
Mitigation
Upgrade GitLab to version 15.7.8, 15.8.4, 15.9.2 or later. Alternatively, implement rate limiting at the web application firewall or reverse proxy level for commit-related API endpoints as a compensating control.