sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-1736 Uncontrolled Resource Consumption in GitLab

Medium 6.5 Published Updated

Attackers can cause denial of service in GitLab by submitting maliciously crafted CI/CD configuration files to the pipeline editor.

Exploited in the wild
Not known
Login needed
Any signed-in user
Attackable
Over the internet
Victim action needed
Not needed
Fix
Available

What is CVE-2024-1736?

CVE-2024-1736 is a medium-severity denial of service vulnerability in Gitlab Gitlab, published on 12 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's CI/CD pipeline editor could allow for denial of service attacks through maliciously crafted configuration files.

Weakness: CWE-1333

Which versions are affected by CVE-2024-1736?

1 open source package ship an affected version, including gitlab. It affects 1 product.

PackageAffectedFixed in
gitlab BitnamiFrom 15.8.016.10.7, 16.11.4, 17.0.2

Products include Gitlab Gitlab.

How do I fix CVE-2024-1736?

Upgrade gitlab to a fixed version for your release line: 16.10.7, 16.11.4 or 17.0.2.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-1736 being exploited?

There is no known exploitation of CVE-2024-1736 in the wild and no public exploit code.

All Gitlab Gitlab vulnerabilities

Sources

Also known as BIT-gitlab-2024-1736, GHSA-28j9-fq4c-qrqg, UBUNTU-CVE-2024-1736.

Is CVE-2024-1736 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free