HIGH
CVE-2024-8237
CVSS
7.5
Description
A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior to 17.6.1. An attacker could cause a denial of service with a crafted cargo.toml file.
Summary dbcve.org
A Denial of Service vulnerability exists in GitLab CE/EE's cargo.toml file parsing logic. An attacker can trigger excessive resource consumption or a crash by submitting a specially crafted cargo.toml file (Rust package manifest), likely through a project import or package upload feature.
Mitigation
Upgrade GitLab to version 17.6.1, 17.5.3, 17.4.5, or 12.6 or later to patch the vulnerability. Alternatively, restrict or validate cargo.toml uploads until patching is possible.
Weakness (CWE)
CWE-407
EPSS Score
0.61%
Probability of exploitation in next 30 days
47.7th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.