Loading vulnerability…
ReDoS in GitLab Harbor Registry Search
CVE-2023-0632 is a Regular Expression Denial of Service (ReDoS) vulnerability in GitLab affecting all versions from 15.2 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. The vulnerability exists in the Harbor Registry search functionality, where crafted payloads can trigger inefficient regular expression processing, leading to excessive resource consumption.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can exploit this vulnerability by submitting specially crafted search payloads to the Harbor Registry, causing the GitLab instance to consume excessive CPU resources. This can result in degraded performance or denial of service for legitimate users.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict access to the Harbor Registry search functionality to trusted users only, and monitor for abnormal resource usage patterns indicative of ReDoS attempts.
Patch, then assume compromise.
Upgrade GitLab to version 16.0.8, 16.1.3, 16.2.2, or later, where the vulnerable regular expression handling has been fixed.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.