CVE-2022-1100

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-772

Affected software

VendorProductVersions
GitLabGitLab>=13.1, <14.7.7; >=14.8, <14.8.5; >=14.9, <14.9.2

References

Timeline

Published
Apr 4, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-11019.8A vulnerability was found in SourceCodester Royale Event Management System 1.0. It has been rated as critical. This issue affects some unknoCVE-2022-11026.1A vulnerability classified as problematic has been found in SourceCodester Royale Event Management System 1.0. Affected is an unknown functiCVE-2022-11038.8The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, whCVE-2022-11044.8The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege useCVE-2022-11054.3An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 pCVE-2022-11069.1use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.CVE-2022-11076.7During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovereCVE-2022-11086.7A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could beCVE-2022-11097.5An incorrect default permissions vulnerability in Lenovo Leyun cloud music application could allow denial of service.CVE-2022-11105.5A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of serCVE-2022-11112.7A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 underCVE-2022-11125.4The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not sanitise as well as
CVE-2022-1100: Medium severity, CVSS 4.3 | Vulnix