Loading vulnerability…
Regular Expression Denial of Service in GitLab RefMatcher
CVE-2024-2800 is a regular expression denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition. RefMatcher can perform excessive regular expression backtracking when matching branch names against wildcard patterns, allowing crafted matching inputs to cause denial of service. Affected versions are 11.3 through versions before 17.0.6, 17.1 before 17.1.4, and 17.2 before 17.2.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Excessive regular expression backtracking can exhaust processing resources and degrade or interrupt GitLab service availability. The vulnerability is rated medium severity with a CVSS score of 6.5. No confidentiality or integrity impact is established.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure to untrusted branch-name matching operations where feasible, restrict who can create or manipulate branch names and related wildcard-based workflows, and monitor for abnormal CPU spikes or request patterns associated with branch reference matching. These measures are only temporary risk reductions and do not eliminate the underlying flaw.
Patch, then assume compromise.
Upgrade affected GitLab CE/EE installations to 17.0.6, 17.1.4, or 17.2.2, as appropriate for the installed release branch, or to a later supported release containing the fix. These patches were released on August 7, 2024.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.