CVE-2023-6386 — Allocation of Resources Without Limits or Throttling in Gitlab

CWE-770 — Allocation of Resources Without Limits or Throttling5 documents5 sources
Severity
7.5HIGHNVD
EPSS
2.8%
top 13.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedFeb 5

Description

A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 which allows an attacker to spike the GitLab instance resource usage resulting in service degradation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab15.11 — 16.6.7+2
▶NVDgitlab/gitlab15.11.0 — 16.6.7+2
▶debiandebian/gitlab< gitlab 16.6.7-1 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
OSV
CVE-2023-6386: A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15↗2025-02-05
▶
GHSA
GHSA-vxw5-rxj4-h92f: A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15↗2025-02-05
▶

📋Vendor Advisories

2
GitLab
CVE-2023-6386: A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 pri↗2025-02-05
▶
Debian
CVE-2023-6386: gitlab - A denial of service vulnerability was identified in GitLab CE/EE, affecting all ...↗2023
▶