CVE-2024-6826: Allocation of Resources Without Limits or Throttling in GitLab
Published Oct 23, 2024
·Updated
An issue has been discovered in GitLab CE/EE affecting all versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1. A denial of service could occur via importing a malicious crafted XML manifest file.
Affected Software
7 affected componentsFixes available
GitLab GitLab>=11.2.0<17.3.6
GitLab GitLab>=11.2.0<17.3.6
GitLab GitLab>=17.4.0<17.4.3
GitLab GitLab>=17.4.0<17.4.3
GitLab GitLab=17.5.0
GitLab GitLab=17.5.0
GitLab GitLab>=11.2<17.3.6, >=17.4<17.4.3, >=17.5<17.5.1
17.3.617.4.317.5.1
Remediation
Information
Upgrade to versions 17.3.6, 17.4.3, 17.5.1 or above.
Event History
Oct 24, 2024
CVE Published
via MITRE·09:30 AM
Data Sourced
via MITRE·09:30 AM
RemedyDescriptionSeverityWeakness
Apr 22, 2026
Data Sourced
via GitLab·08:55 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-6826?
CVE-2024-6826 has been classified as a denial of service vulnerability.
2
How do I fix CVE-2024-6826?
To mitigate CVE-2024-6826, upgrade GitLab to version 17.3.6 or later, 17.4.3 or later, or 17.5.1 or later.
3
Which versions of GitLab are affected by CVE-2024-6826?
CVE-2024-6826 affects all GitLab CE and EE versions from 11.2 before 17.3.6, 17.4 before 17.4.3, and 17.5 before 17.5.1.
4
What type of attack does CVE-2024-6826 involve?
CVE-2024-6826 involves a denial of service attack via importing a maliciously crafted XML manifest file.
5
Is there a workaround for CVE-2024-6826 if I cannot upgrade?
Currently, there are no official workarounds mentioned for CVE-2024-6826 other than upgrading to a fixed version.