Unrated severityNVD Advisory· Published Sep 1, 2023· Updated Apr 21, 2026
Allocation of Resources Without Limits or Throttling in GitLab
CVE-2023-4647
Description
An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances.
Affected products
3cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 15.2
- (no CPE)range: <16.1.5 (for 15.2-16.1), <16.2.5 (for 16.2), <16.3.1 (for 16.3)
Patches
Vulnerability mechanics
References
1- gitlab.com/gitlab-org/gitlab/-/issues/414502mitreissue-trackingpermissions-required
News mentions
1- GitLab Security Release: 16.3.1, 16.2.5, and 16.1.5GitLab Security Releases · Aug 31, 2023