← Back to browse · API

CVE-2023-0921

Severity
MEDIUM
CVSS
4.3
EPSS
0.84438
Risk score
46.75
CISA KEV
No
PoC
No
Published
2023-06-06
Modified
2025-01-07
First seen
2026-08-07
Aliases
EUVD-2023-12908, GHSA-P96P-59V7-XXP6
Products
GitLab:GitLab 15.11, <15.11.7, GitLab:GitLab 16.0, <16.0.2, GitLab:GitLab 8.3, <15.10.8
Sources
euvd EUVD-2023-12908

Description

A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.

References