MEDIUM
CVE-2024-3114
CVSS
6.5
Description
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the processing logic for parsing invalid commits can lead to a regular expression DoS attack on the server.
Summary dbcve.org
A regular expression denial of service (ReDoS) vulnerability exists in GitLab CE/EE's commit parsing logic. When processing invalid commits, the regex engine can be forced into excessive backtracking, causing server resource exhaustion and DoS.
Mitigation
Upgrade GitLab to version 17.0.6, 17.1.4, 17.2.2 or later. This is a patch-update only; no configuration changes required.
Weakness (CWE)
CWE-1333
EPSS Score
0.46%
Probability of exploitation in next 30 days
39.3th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.