GitLab CE/EE Denial-of-Service Vulnerability in CI Configuration Processing

A denial-of-service vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 13.7 prior to 18.8.7, 18.9 prior to 18.9.3, and 18.10 prior to 18.10.1. This vulnerability could allow an authenticated user to cause excessive resource consumption by the GitLab instance when processing certain Continuous Integration (CI)-related inputs, leading to a degradation of service.

Impact

Exploitation of this vulnerability causes excessive resource consumption, making the GitLab instance unresponsive and causing a denial-of-service condition.

Remediation

GitLab has released patch versions 18.10.1, 18.9.3, and 18.8.7. Instructions for updating GitLab can be found on the GitLab Update page. Note that the SLES 12.5 package is not available for GitLab 18.10.1.