Loading vulnerability…
ReDoS in GitLab CE/EE Wiki Render API/Page
CVE-2023-6502 is a regular expression denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition affecting the wiki render API/page. A crafted wiki page can trigger excessive processing during wiki rendering, leading to a denial-of-service condition. The issue affects all versions before 16.10.6, version 16.11 before 16.11.3, and version 17.0 before 17.0.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can degrade availability of the affected GitLab instance by causing the application to spend excessive resources processing a malicious wiki page. This can result in service slowdown or temporary unavailability of wiki rendering functionality and potentially broader application responsiveness issues.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to wiki creation and editing to trusted users, closely monitor application performance around wiki rendering activity, and consider temporarily disabling or limiting exposure of affected wiki functionality until the upgrade can be completed. GitLab.com was already running a patched version at the time of disclosure.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. The vulnerability is addressed in 16.10.6, 16.11.3, and 17.0.1. Self-managed installations should update to one of these versions or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.