CVE-2024-11828: Inefficient Algorithmic Complexity in GitLab
A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-11828.
Other sources
A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API calls. This was a regression of an earlier patch.
— MITRE
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-11828?
CVE-2024-11828 has been classified as a denial of service (DoS) vulnerability affecting multiple versions of GitLab.
How do I fix CVE-2024-11828?
To remediate CVE-2024-11828, upgrade your GitLab installation to version 17.4.6 or later, or 17.5.3 or later.
Which versions of GitLab are affected by CVE-2024-11828?
CVE-2024-11828 affects GitLab versions from 13.2.4 to 17.4.5, as well as 17.5.0 to 17.5.2 and version 17.6.0.
What types of attacks can exploit CVE-2024-11828?
CVE-2024-11828 can be exploited through crafted API calls leading to a denial of service condition.
Is there a workaround for CVE-2024-11828?
No official workaround is provided for CVE-2024-11828; the recommended action is to apply the necessary updates.