HIGH

CVE-2024-2800

Gitlab GitLab 2024-08-08 CVSS v3.1

CVSS

7.5

Description

ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allows denial of service via Regex backtracking.

Summary dbcve.org

A ReDoS (Regular Expression Denial of Service) vulnerability exists in GitLab's RefMatcher component when processing branch names with wildcards. The regex pattern used for matching can trigger excessive backtracking, causing denial of service through CPU exhaustion.

Mitigation

Upgrade GitLab to version 17.0.6, 17.1.4, 17.2.2 or later to receive the patch for this vulnerability.

Weakness (CWE)

CWE-1333

EPSS Score

0.68%

Probability of exploitation in next 30 days

50.7th percentile

References

https://gitlab.com/gitlab-org/gitlab/-/issues/451293 Broken Link https://hackerone.com/reports/2416332 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE