CVE-2023-3364CWE-1333

Inefficient Regular Expression Complexity in GitLab

High · published August 1, 2023

CVSS v3.1

7.5

EPSS

44%

Percentile

98.8

In the wild

Unconfirmed

What it is

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use AutolinkFilter to the preview_markdown endpoint.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.44494 · 98.8th percentile
Weakness: CWE-1333 · Inefficient Regular Expression Complexity
Published: 2023-08-01T23:36Z

EPSS history

Timeline

01 AUG 23:36Z
Inefficient Regular Expression Complexity in GitLab
cvelistv5