Loading vulnerability…
Denial of Service in GitLab CE/EE via crafted AsciiDoc files
CVE-2024-4210 is a denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition. It affects all versions starting with 12.6 before 17.0.6, 17.1 before 17.1.4, and 17.2 before 17.2.2. The flaw can be triggered by supplying crafted AsciiDoc (adoc) files to GitLab, causing the application to enter a resource-exhaustion condition during processing of that content. Publicly available details identify the issue as a DoS condition tied to crafted adoc files, but do not provide the specific vulnerable function or parser component.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause GitLab to become unavailable or degraded by exhausting application resources while processing maliciously crafted AsciiDoc content. The primary impact is denial of service against affected GitLab instances, which can disrupt normal repository or web application operations for users.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure to untrusted AsciiDoc content and restrict the ability of untrusted users to submit or render crafted adoc files in workflows processed by GitLab. Additional temporary risk reduction may include limiting resource consumption at the application or infrastructure layer to reduce the impact of parser-triggered exhaustion. Specific vendor-provided mitigations beyond upgrading are not currently available.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. The patched versions are 17.0.6, 17.1.4, and 17.2.2 or later, depending on the deployment branch. Self-managed installations running affected versions should be updated immediately to one of these releases or a newer maintained version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.