High severity7.5NVD Advisory· Published Aug 2, 2023· Updated Jun 17, 2026
CVE-2023-3364
CVE-2023-3364
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint.
Affected products
6cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 8.14
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=8.14,<16.0.8
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=8.14,<16.0.8
- (no CPE)range: starting from 8.14 before 16.0.8, starting from 16.1 before 16.1.3, starting from 16.2 before 16.2.2
- Range: starting from 8.14 before 16.0.8, starting from 16.1 before 16.1.3, starting from 16.2 before 16.2.2
Patches
Vulnerability mechanics
References
2- gitlab.com/gitlab-org/gitlab/-/issues/415995nvdBroken Link
- hackerone.com/reports/1959727nvdPermissions Required
News mentions
1- GitLab Security Release: 16.2.2, 16.1.3, and 16.0.8GitLab Security Releases · Aug 1, 2023