Loading vulnerability…
Denial of Service via Cyclic Epic References in GitLab CE/EE
CVE-2024-6324 is an inefficient algorithmic complexity vulnerability in GitLab Community Edition and Enterprise Edition that can be triggered by creating cyclic references between epics. The flaw allows specially crafted epic relationships to cause excessive resource consumption during processing of those references, resulting in a denial-of-service condition. The issue affects GitLab CE/EE versions starting from 15.7 before 17.5.5, starting from 17.6 before 17.6.3, and starting from 17.7 before 17.7.1. Additional later patch trains indicate the issue was also addressed in 17.6.4, 17.7.3, and 17.8.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can degrade or disrupt GitLab availability by exhausting server resources while the application processes cyclic epic relationships. Based on the published CVSS vector, the primary impact is limited to availability, with no direct confidentiality or integrity impact established.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict the ability to create or modify epics and their references to trusted users, and monitor for abnormal resource consumption or application instability associated with epic processing. Because the issue is rooted in application logic, mitigation is only partial until a fixed version is deployed.
Patch, then assume compromise.
Upgrade GitLab CE/EE to a fixed release. Published fixes include 17.5.5, 17.6.3, and 17.7.1, with subsequent patch releases 17.6.4, 17.7.3, and 17.8.1 also containing the mitigation. Self-managed deployments should move to the latest supported patched version in their upgrade path.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.