GitLab CE/EE Denial-of-Service Vulnerability in Notes Endpoint

A denial-of-service vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 9.2 prior to 18.9.6, 18.10 prior to 18.10.4, and 18.11 prior to 18.11.1. This vulnerability allowed authenticated users to exhaust server resources by sending crafted requests to the notes endpoint, under certain conditions, leading to service disruption.

Impact

Exploitation of this vulnerability could cause a significant degradation of server performance, potentially leading to a complete service outage.

Remediation

Users are advised to upgrade to GitLab versions 18.11.1, 18.10.4, or 18.9.6. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, refer to the Updating the Runner page.