CVE-2024-7610

MEDIUM

GitLab 15.9-17.0.5, 17.1-17.1.3, 17.2-17.2.1 - Denial of Service via Elasticsearch Result Parsing

Title source: llm

Description

A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. It is possible for an attacker to cause catastrophic backtracking while parsing results from Elasticsearch.

References (1)

Core 1

Core References

Broken Link issue-tracking permissions-required

https://gitlab.com/gitlab-org/gitlab/-/issues/468917

Scores

CVSS v3 4.3

EPSS 0.0006

EPSS Percentile 18.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-400

Status published

Products (1)

gitlab/gitlab 15.9.0 - 17.0.6 (2 CPE variants)

Published Aug 08, 2024

Tracked Since Feb 18, 2026