CVE-2024-12379: Allocation of Resources Without Limits or Throttling in GitLab
A denial of service vulnerability in GitLab CE/EE affecting all versions from 14.1 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to impact the availability of GitLab via unbounded symbol creation via the scopes parameter in a Personal Access Token.
Affected Software
Remediation
Information
Patch Available
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-12379?
CVE-2024-12379 is classified as a denial of service vulnerability that can severely impact the availability of GitLab.
How do I fix CVE-2024-12379?
To fix CVE-2024-12379, you should upgrade GitLab CE/EE to version 17.6.5 or later, 17.7.4 or later, or 17.8.2 or later.
Which versions of GitLab are affected by CVE-2024-12379?
CVE-2024-12379 affects all GitLab CE/EE versions from 14.1 to earlier than 17.6.5, 17.7 to earlier than 17.7.4, and 17.8 to earlier than 17.8.2.
What type of vulnerability is CVE-2024-12379?
CVE-2024-12379 is a denial of service vulnerability that targets GitLab through unbounded symbol creation.
Can CVE-2024-12379 be exploited remotely?
Yes, CVE-2024-12379 can be exploited remotely by an attacker to compromise the availability of the GitLab service.