CVE-2021-22210 Denial of service in GitLab

Medium 5.3 Published 6 May 2021 Updated 3 Aug 2024

Attackers can cause denial of service by querying repository branches via API, ignoring pagination limits and returning excessive results.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-22210?

CVE-2021-22210 is a medium-severity denial of service vulnerability in Gitlab Gitlab, published on 6 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring a query parameter and returning a considerable amount of results.

Weakness: CWE-770

Which versions are affected by CVE-2021-22210?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `13.2.0`	`13.9.7, 13.10.4, 13.11.2`

Products include Gitlab Gitlab.

How do I fix CVE-2021-22210?

Upgrade gitlab to a fixed version for your release line: 13.9.7, 13.10.4 or 13.11.2.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-22210 being exploited?

There is no known exploitation of CVE-2021-22210 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2021-22210, GHSA-c8rf-2f6q-cprc, UBUNTU-CVE-2021-22210.