Loading vulnerability…
ReDoS in GitLab CE/EE invalid commit parsing during git push
CVE-2024-3114 is a regular expression denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition. It affects all versions from 11.10 before 17.0.6, 17.1 before 17.1.4, and 17.2 before 17.2.2. The flaw is in the processing logic used to parse invalid commits during git push handling. A crafted input can trigger inefficient regular expression evaluation and catastrophic backtracking, causing excessive CPU consumption on the server while the invalid commit data is being parsed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause server-side denial of service by consuming excessive processing resources during git push processing. The primary impact is degradation or interruption of GitLab service availability, potentially affecting repository operations and overall responsiveness of the instance.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting who can push to affected repositories and restricting access to GitLab instances to trusted users where feasible. Monitor for abnormal CPU utilization or repeated malformed git push activity and apply operational rate limiting or other protective controls around repository write operations until the upgrade can be completed. Specific vendor-supported mitigations beyond upgrading are not currently available in the provided information.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release: 17.0.6, 17.1.4, 17.2.2, or a later patched version. Self-managed installations running affected versions should be updated promptly to a release containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.