CVE-2023-2198
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.
Summary dbcve.org
A Regular Expression Denial of Service (ReDoS) vulnerability exists in GitLab CE/EE's preview_markdown endpoint across multiple affected version ranges. Attackers can send specially crafted payloads that cause the regex engine to consume excessive CPU resources, leading to service degradation or unavailability.
Mitigation
Upgrade GitLab to version 15.10.8, 15.11.7, 16.0.2 or later. There are no configuration-based workarounds; the vulnerability is in the regex processing logic and requires the vendor patch.