Loading vulnerability…
Denial of Service in GitLab CE/EE test_report API
CVE-2024-1947 is a resource-exhaustion denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition. It affects versions from 13.2.4 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. The issue is exposed through the test_report API, where crafted API requests can trigger excessive resource consumption and cause a denial-of-service condition. The available information identifies the vulnerable surface as crafted test_report API calls, but does not provide lower-level implementation details such as the exact function or code path involved.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can degrade availability of the GitLab instance by exhausting server resources and causing denial of service. This can disrupt normal operation of the application and prevent legitimate users or automated processes from reliably accessing affected GitLab functionality.
If you can’t patch tonight, do this now.
Apply the vendor-provided patched release. If immediate patching is not possible, reduce exposure of the affected API to untrusted users where operationally feasible, including restricting access to the API surface and monitoring for abusive or anomalous request patterns that could indicate resource-exhaustion attempts. Specific vendor mitigation details beyond upgrading are not available.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. The vulnerability is addressed in versions 16.10.6, 16.11.3, and 17.0.1. Self-managed installations running affected versions should update to the appropriate patched version as soon as possible.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.