GitLab CE/EE Denial-of-Service Vulnerability in User-Controlled Fields

A denial-of-service vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 15.0 prior to 18.1.6, 18.2 prior to 18.2.6, and 18.3 prior to 18.3.2. This vulnerability could have allowed an authenticated user to disrupt background job processing by sending specially crafted commit messages, merge request descriptions, or notes.

Impact

Exploitation of this vulnerability could have led to a persistent denial-of-service condition, causing background job processing to stall and potentially disrupting normal user activities on the GitLab instance.

Remediation

Users are strongly advised to upgrade to GitLab versions 18.3.2, 18.2.6, or 18.1.6. Instructions for updating GitLab can be found in the GitLab Update documentation. For GitLab Runner, refer to the Updating the Runner page.