Loading vulnerability…
Uncontrolled CPU Consumption in GitLab Merge Request Terraform File Rendering
CVE-2024-10307 is an uncontrolled resource consumption vulnerability in GitLab Community Edition and Enterprise Edition. It affects all versions from 12.10 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1. The issue is triggered by a maliciously crafted Terraform file associated with a merge request. When the merge request is viewed, GitLab processes the crafted file in a way that can cause uncontrolled CPU consumption. The vulnerability is a denial-of-service condition in the merge request viewing workflow rather than a memory corruption or code execution flaw.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause excessive CPU utilization on the GitLab instance when the affected merge request is viewed. This can degrade application responsiveness, consume shared compute resources, and potentially lead to partial denial of service for users interacting with the platform. Based on the available information, the primary impact is service degradation or disruption rather than unauthorized access or code execution.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting who can submit or modify merge requests containing Terraform content and by limiting access to view untrusted merge requests until the instance is upgraded. Operational monitoring for abnormal CPU spikes during merge request rendering may help detect exploitation attempts, but no complete mitigation short of upgrading is currently available from the provided information.
Patch, then assume compromise.
Upgrade GitLab EE/CE to a fixed release. The patched versions are 17.8.6, 17.9.3, and 17.10.1 or later, depending on the deployed release train. Self-managed installations should be updated to one of these versions or a newer supported version that includes the fix. GitLab.com was already patched at the time of disclosure.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.