CVE-2024-2651: Inefficient Regular Expression Complexity in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. It was possible for an attacker to cause a denial of service using maliciously crafted markdown content.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-2651?
CVE-2024-2651 has been classified as a denial of service vulnerability that can impact the availability of GitLab.
How do I fix CVE-2024-2651?
To fix CVE-2024-2651, upgrade your GitLab installation to version 16.9.7 or later, or versions 16.10.5 and above, or versions 16.11.2 and above.
Which versions are affected by CVE-2024-2651?
CVE-2024-2651 affects all versions of GitLab prior to 16.9.7, from 16.10.0 up to but not including 16.10.5, and from 16.11.0 up to but not including 16.11.2.
What type of attack does CVE-2024-2651 allow?
CVE-2024-2651 allows attackers to perform a denial of service attack using maliciously crafted markdown content.
Is CVE-2024-2651 present in GitLab CE, EE, or both?
CVE-2024-2651 is present in both GitLab Community Edition (CE) and GitLab Enterprise Edition (EE) across the specified affected versions.