CVE-2023-3994
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.
Summary dbcve.org
A Regular Expression Denial of Service (ReDoS) vulnerability exists in GitLab's preview_markdown endpoint via the ProjectReferenceFilter component. Attackers can send specially crafted payloads containing malicious regex patterns that cause excessive CPU consumption and service unavailability.
Mitigation
Upgrade GitLab to version 16.0.8, 16.1.3, 16.2.2 or later to patch the vulnerable regex pattern. Consider rate-limiting the preview_markdown endpoint as an interim mitigation.