CVE-2024-12379 — Allocation of Resources Without Limits or Throttling in Gitlab

CWE-770 — Allocation of Resources Without Limits or Throttling5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 80.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedFeb 12

Description

A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter in a Personal Access Token.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab14.1 — 17.6.5+2
▶NVDgitlab/gitlab14.1.0 — 17.6.5+2
▶debiandebian/gitlab< gitlab 17.6.5-1 (sid)
▶gitlabgitlab/gitlab

Patches

Patch: gitlab.com ↗

🔴Vulnerability Details

2
OSV
CVE-2024-12379: A denial of service vulnerability in GitLab CE/EE affecting all versions from 14↗2025-02-12
▶
GHSA
GHSA-v488-9cvj-5mx7: A denial of service vulnerability in GitLab CE/EE affecting all versions from 14↗2025-02-12
▶

📋Vendor Advisories

2
GitLab
CVE-2024-12379: A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 all↗2025-02-12
▶
Debian
CVE-2024-12379: gitlab - A denial of service vulnerability in GitLab CE/EE affecting all versions from 14...↗2024
▶