CVE-2021-22166 - An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method

HIGH

An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method

Published Jan 15, 2021

7.5

HIGH

CVSS 3.1

EPSS 1.38%

An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
>=13.7, <13.7.2	affected	-

No remediation recorded yet.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-9312		Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22166.json		x_refsource_CONFIRMThird Party Advisory
https://gitlab.com/gitlab-org/labkit/-/issues/29		x_refsource_MISCBroken Link