CVE-2021-22166

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Jan 15, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-221677.5An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attackerCVE-2021-221686.5A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8.CVE-2021-221694.3An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.CVE-2021-22174.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.CVE-2021-221707.5Assuming a database breach, nonce reuse issues in GitLab 11.6+ allows an attacker to decrypt some of the database's encrypted contentCVE-2021-221716.5Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if thCVE-2021-221724.3Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releasesCVE-2021-221737.5Memory leak in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture fileCVE-2021-221747.5Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture fileCVE-2021-221759.8When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versionsCVE-2021-221764.3An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members toCVE-2021-221774.3Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource
CVE-2021-22166: High severity, CVSS 7.5 | Vulnix