HIGH
CVE-2023-3364
CVSS
7.5
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint.
Summary dbcve.org
A Regular Expression Denial of Service (ReDoS) vulnerability exists in GitLab's preview_markdown endpoint via the AutolinkFilter component. Attackers can send crafted regex payloads that cause excessive backtracking, leading to CPU exhaustion and service unavailability.
Mitigation
Upgrade GitLab to version 16.0.8, 16.1.3, 16.2.2 or later to patch the vulnerable regex patterns in the AutolinkFilter.
Weakness (CWE)
CWE-1333
EPSS Score
44.49%
Probability of exploitation in next 30 days
98.7th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.