CVE-2023-6489 - Inefficient Regular Expression Complexity in GitLab

Back Back to CVE browser

MEDIUM

Inefficient Regular Expression Complexity in GitLab

Published Apr 12, 2024

6.5

MEDIUM

CVSS 3.1

EPSS 0.60%

Description

A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  16.10
  Status
  affected
  Constraints
  <16.10.2
- Version
  16.7.7
  Status
  affected
  Constraints
  <16.8.6
- Version
  16.9
  Status
  affected
  Constraints
  <16.9.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
16.10	affected	<16.10.2
16.7.7	affected	<16.8.6
16.9	affected	<16.9.4

Remediation

Vendor solution

Upgrade to versions 16.8.6, 16.9.4, 16.10.2 or above.

Weaknesses (1)

CWE-1333

References (2)

https://gitlab.com/gitlab-org/gitlab/-/issues/433520
issue-trackingpermissions-requiredBroken Link
https://hackerone.com/reports/2262450
technical-descriptionexploitpermissions-requiredbroken-linkPermissions Required

Link	Providers	Tags
https://gitlab.com/gitlab-org/gitlab/-/issues/433520		issue-trackingpermissions-requiredBroken Link
https://hackerone.com/reports/2262450		technical-descriptionexploitpermissions-requiredbroken-linkPermissions Required

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitLab

Published Apr 12, 2024

Updated Aug 14, 2026

Reserved Dec 4, 2023

Link CVE-2023-6489

CISA Vulnrichment

Updated Jul 8, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2023-6489

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-6489