Loading vulnerability…
Denial of Service in GitLab CE/EE via large glm_source POST parameter
CVE-2024-8124 is a high-severity denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition. It affects all versions from 16.4 before 17.1.7, from 17.2 before 17.2.5, and from 17.3 before 17.3.2. The issue can be triggered remotely by sending a specific POST request containing a sufficiently large glm_source parameter, causing the GitLab service to become unavailable. The available information identifies the vulnerable input vector as request handling for the glm_source parameter, but does not provide function-level implementation details.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause service unavailability in affected GitLab CE/EE instances. The vulnerability is described as a denial-of-service condition and is rated CVSS 7.5, indicating that a remote unauthenticated attacker can disrupt availability without user interaction. No evidence is provided that the issue enables code execution, privilege escalation, or confidentiality compromise.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of GitLab HTTP endpoints to untrusted networks, apply upstream or reverse-proxy request size limits for POST bodies and parameters where operationally feasible, and monitor for abnormal requests that may attempt to submit oversized glm_source values. These measures may reduce exploitability but are not a substitute for upgrading to a fixed version.
Patch, then assume compromise.
Upgrade affected self-managed GitLab CE/EE installations to a fixed release: 17.1.7 or later on the 17.1 branch, 17.2.5 or later on the 17.2 branch, or 17.3.2 or later on the 17.3 branch. Later supported releases that include these fixes should also remediate the issue.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.