VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Aug 2, 2023· Updated Jun 17, 2026

CVE-2023-3900

CVE-2023-3900

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load.

Affected products

6
  • GitLab Inc./GitLabv54 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 16.1
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=16.1,<16.1.3
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=16.1,<16.1.3
    • (no CPE)range: starts from 16.1 before 16.1.3, starts from 16.2 before 16.2.2
  • GitLab Inc./gitlab-org/gitlab-eellm-fuzzy
    Range: starts from 16.1 before 16.1.3, starts from 16.2 before 16.2.2
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 16.1.0, < 16.1.3

Patches

Vulnerability mechanics

References

2

News mentions

1