GitLab CE/EE Denial-of-Service Vulnerability in Webhook Endpoint

A denial-of-service vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 9.3 prior to 18.7.6, 18.8 prior to 18.8.6, and 18.9 prior to 18.9.2. Under certain conditions, this vulnerability allowed an authenticated user to disrupt service by improperly managing webhook response data.

Impact

Exploitation of this vulnerability could lead to a denial-of-service condition, causing the application to become unresponsive or unavailable.

Remediation

GitLab has released patch versions 18.9.2, 18.8.6, and 18.7.6. Instructions for updating GitLab can be found on the GitLab Update page. After updating, it's important to verify that the application is running the patched version.