CVE-2024-7803: Allocation of Resources Without Limits or Throttling in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. A Discord webhook integration may cause DoS.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.10.7Fixed in 17.11.3Fixed in 18.0.1 - Upgrade
Upgrade
GitLab CE/EE 17.10to a version that resolves this vulnerability.Fixed in 17.10.7 - Upgrade
Upgrade
GitLab CE/EE 17.11to a version that resolves this vulnerability.Fixed in 17.11.3 - Upgrade
Upgrade
GitLab CE/EE 18.0to a version that resolves this vulnerability.Fixed in 18.0.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-7803?
CVE-2024-7803 is classified as a denial-of-service vulnerability.
How do I fix CVE-2024-7803?
To mitigate CVE-2024-7803, upgrade GitLab CE/EE to version 17.10.7 or later, version 17.11.3 or later, or version 18.0.1.
Which versions of GitLab are affected by CVE-2024-7803?
CVE-2024-7803 affects GitLab CE and EE versions prior to 17.10.7, 17.11.3, and 18.0.1.
What type of attack does CVE-2024-7803 facilitate?
CVE-2024-7803 can be exploited to perform a denial-of-service (DoS) attack through a Discord webhook integration.
Is there any public report available for CVE-2024-7803?
Yes, information about CVE-2024-7803 can be found in public issue reports on GitLab.