CVE-2021-39932

Vulnerability

An issue in GitLab CE/EE affects all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, and all versions starting from 14.5 before 14.5.2. The diff feature does not properly limit payload sizes, allowing an attacker to craft large payloads that trigger high load times when users review code changes [1].

Exploitation

An attacker needs to have access to create merge request drafts or comments with diff positions. By submitting a crafted diff note with an oversized or complex payload in the position field, the attacker can cause excessive server-side processing when the diff is rendered for review. No special network position or authentication beyond the ability to create merge request notes is required [1].

Impact

Successful exploitation leads to a denial of service condition where users reviewing code changes experience significant load times, degrading the user experience and potentially impacting availability of the review interface [1].

Mitigation

GitLab released fixed versions 14.3.6, 14.4.4, and 14.5.2 on December 13, 2021. Users should upgrade to these or later versions. No workaround is documented in the available references [1].