CVE-2023-3900 Improper Validation of Specified Type of Input in GitLab

Medium 4.3 Published 2 Aug 2023 Updated 20 Nov 2025

An attacker can cause a Denial of Service in GitLab by providing an invalid start_sha value, preventing the Changes tab from loading.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-3900?

CVE-2023-3900 is a medium-severity denial of service vulnerability in Gitlab Gitlab, published on 2 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'start_sha' value on merge requests page may lead to Denial of Service as Changes tab would not load.

Weakness: CWE-1287

Which versions are affected by CVE-2023-3900?

1 open source package ship an affected version, including gitlab. It affects 1 product.

Package	Affected	Fixed in
`gitlab` Bitnami	From `16.1.0`	`16.1.3, 16.2.2`

Products include Gitlab Gitlab.

How do I fix CVE-2023-3900?

Upgrade gitlab to a fixed version for your release line: 16.1.3 or 16.2.2.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-3900 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3900 exists.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2023-3900, GHSA-mr7p-gv96-xc44, UBUNTU-CVE-2023-3900.