Loading vulnerability…
Resource Consumption DoS in GitLab EE Dependency List
CVE-2023-4011 is an uncontrolled resource-consumption vulnerability in GitLab Enterprise Edition. Loading the Dependency List page can cause a resource-consumption spike, potentially making the affected GitLab service unavailable. It affects GitLab EE versions from 15.11 before 16.2.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can cause elevated resource consumption and potentially deny service to GitLab EE users by triggering processing associated with the Dependency List page.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, consider rate limiting, resource quotas, or network-level protections to reduce the risk of resource exhaustion attacks until the patch can be applied.
Patch, then assume compromise.
Upgrade affected GitLab installations to a patched release. GitLab released fixes in versions 16.2.2, 16.1.3, and 16.0.8 and advised affected installations to upgrade immediately.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.