Loading vulnerability…
Denial of Service via crafted runner description in GitLab CE/EE
CVE-2024-2874 is a denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition affecting all versions before 16.10.6, version 16.11 before 16.11.3, and version 17.0 before 17.0.1. The issue is triggered when a GitLab Runner is registered with a crafted description value. Processing or rendering that malicious runner description can disrupt the loading of targeted GitLab web resources, resulting in availability impact within the web interface. The available information identifies the runner description field as the attack vector but does not provide the exact vulnerable function or code path.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause targeted GitLab web resources to fail to load or become disrupted, producing a denial-of-service condition against portions of the GitLab web interface. The reported impact is on availability rather than confidentiality or integrity.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting who can register runners and by reviewing or controlling runner metadata submitted during registration, especially description fields. Limit lower-privileged users' ability to create or register runners where operationally feasible, and monitor for malformed or suspicious runner descriptions until the upgrade can be completed. Specific vendor mitigation details beyond upgrading are not available.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. Patched versions include 16.10.6, 16.11.3, and 17.0.1. Self-managed deployments should update to one of these versions or a later release in the corresponding supported branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.