VYPR
← All advisories
High severity7.5NVD Advisory· Published Aug 2, 2023· Updated Jun 17, 2026

CVE-2023-3994

CVE-2023-3994

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • GitLab Inc./GitLabv53 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 9.3
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=9.3,<16.0.8
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=9.3,<16.0.8
  • GitLab Inc./gitlab-org/gitlab-eellm-fuzzy
    Range: starting from 9.3 before 16.0.8, starting from 16.1 before 16.1.3, starting from 16.2 before 16.2.2
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 9.3.0, < 16.0.8

Patches

Vulnerability mechanics

References

2

News mentions

1