CVE-2024-2829
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.5 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. A crafted wildcard filter in FileFinder may lead to a denial of service.
Summary dbcve.org
A denial of service vulnerability exists in GitLab CE/EE's FileFinder component where a crafted wildcard filter can cause excessive resource consumption, potentially making the service unavailable. The vulnerability is triggered by specially crafted input to the FileFinder feature.
Mitigation
Upgrade GitLab to version 16.9.6, 16.10.4, 16.11.1 or later. Alternatively, if immediate upgrade is not feasible, consider restricting or disabling the FileFinder feature until the patch can be applied.