CVE-2023-5963

LOW

GitLab 13.9-16.3.6, 16.4.0-16.4.1, 16.5.0 - Denial of Service via Advanced Search Syntax Operator Chaining

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that could allow a denial of service in the Advanced Search function by chaining too many syntax operators.

References (1)

Core 1
Core References
Broken Link issue-tracking permissions-required
https://gitlab.com/gitlab-org/gitlab/-/issues/423468

Scores

CVSS v3 3.1
EPSS 0.0001
EPSS Percentile 3.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-770
Status published
Products (5)
gitlab/gitlab 16.5.0
GitLab/GitLab 13.9 - 16.3.6
gitlab/gitlab 13.9.0 - 16.3.6
GitLab/GitLab 16.4.0 - 16.4.2
GitLab/GitLab 16.5.0 - 16.5.1
Published Nov 06, 2023
Tracked Since Feb 18, 2026