CVE-2021-22197 Denial of service in GitLab

Low 3.5 Published 2 Apr 2021 Updated 3 Aug 2024

An authenticated user can cause a denial of service via an infinite loop by accessing a merge request with circular branch references.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-22197?

CVE-2021-22197 is a low-severity denial of service vulnerability in Gitlab Gitlab, published on 2 Apr 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other

Weakness: CWE-835

Which versions are affected by CVE-2021-22197?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `10.6.0`	`13.8.7, 13.9.5, 13.10.1`

Products include Gitlab Gitlab.

How do I fix CVE-2021-22197?

Upgrade gitlab to a fixed version for your release line: 13.8.7, 13.9.5 or 13.10.1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-22197 being exploited?

There is no known exploitation of CVE-2021-22197 in the wild and no public exploit code.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2021-22197, GHSA-74q6-7f58-9g77, UBUNTU-CVE-2021-22197.