Unrated severityNVD Advisory· Published May 23, 2024· Updated Oct 3, 2024
Allocation of Resources Without Limits or Throttling in GitLab
CVE-2024-2874
Description
An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources.
Affected products
3- Range: <16.10.6, >=16.11.0 <16.11.3, >=17.0.0 <17.0.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- hackerone.com/reports/2426166mitretechnical-descriptionexploitpermissions-required
- gitlab.com/gitlab-org/gitlab/-/issues/451911mitreissue-trackingpermissions-required
News mentions
1- GitLab Patch Release: 17.0.1, 16.11.3, 16.10.6GitLab Security Releases · May 22, 2024