CVE-2024-2651: Inefficient Regular Expression Complexity in GitLab
First published: Thu May 09 2024(Updated: )
An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. It was possible for an attacker to cause a denial of service using maliciously crafted markdown content.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | <16.9.7 | |
| GitLab | <16.9.7 | |
| GitLab | >=16.10.0<16.10.5 | |
| GitLab | >=16.10.0<16.10.5 | |
| GitLab | >=16.11.0<16.11.2 | |
| GitLab | >=16.11.0<16.11.2 |
Remedy
Upgrade to versions 16.9.7, 16.10.5, 16.11.2 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-2651?
CVE-2024-2651 has been classified as a denial of service vulnerability that can impact the availability of GitLab.
How do I fix CVE-2024-2651?
To fix CVE-2024-2651, upgrade your GitLab installation to version 16.9.7 or later, or versions 16.10.5 and above, or versions 16.11.2 and above.
Which versions are affected by CVE-2024-2651?
CVE-2024-2651 affects all versions of GitLab prior to 16.9.7, from 16.10.0 up to but not including 16.10.5, and from 16.11.0 up to but not including 16.11.2.
What type of attack does CVE-2024-2651 allow?
CVE-2024-2651 allows attackers to perform a denial of service attack using maliciously crafted markdown content.
Is CVE-2024-2651 present in GitLab CE, EE, or both?
CVE-2024-2651 is present in both GitLab Community Edition (CE) and GitLab Enterprise Edition (EE) across the specified affected versions.
- agent/remedy
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/16.10.0
- version/gitlab/16.11.0