CVE-2022-3759 Denial of service in GitLab

Medium 4.3 Published 13 Feb 2023 Updated 21 Mar 2025

Attackers can cause denial of service by uploading crafted CI artifacts in projects using dynamic child pipelines, impacting GitLab instances with memory-limited Sidekiq.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-3759?

CVE-2022-3759 is a medium-severity denial of service vulnerability in Gitlab Gitlab, published on 13 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this may cause Denial of Service.

Weakness: CWE-400

Which versions are affected by CVE-2022-3759?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `14.3.0`	`15.6.7, 15.7.6, 15.8.1`

Products include Gitlab Gitlab.

How do I fix CVE-2022-3759?

Upgrade gitlab to a fixed version for your release line: 15.6.7, 15.7.6 or 15.8.1.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-3759 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3759 exists.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2022-3759, CVE-2023-0884, GHSA-c729-m2g9-m3xv, UBUNTU-CVE-2022-3759.