Loading vulnerability…
Resource Exhaustion DoS in GitLab Banzai Pipeline
CVE-2024-5423 is a resource-exhaustion vulnerability comprising multiple denial-of-service conditions in the Banzai pipeline of GitLab Community Edition and Enterprise Edition. It affects versions from 1.0 before 17.0.6, versions 17.1 before 17.1.4, and versions 17.2 before 17.2.2. An attacker can trigger resource exhaustion through the Banzai pipeline, causing denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can exhaust GitLab resources and deny service to users of the affected GitLab instance.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting untrusted users' ability to submit content that is processed by the Banzai pipeline, applying rate limiting and resource controls at the application and infrastructure layers, and monitoring for abnormal CPU or memory consumption associated with content-processing operations. These measures are only temporary risk-reduction steps and do not remove the underlying flaw.
Patch, then assume compromise.
Upgrade GitLab CE or EE to 17.0.6, 17.1.4, or 17.2.2, as appropriate for the deployed release line.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.