CVE-2022-1954

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headers

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-1333

Affected software

No affected versions have been published.

Timeline

Published: Jul 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-19554.6Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user d CVE-2022-19564.3The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which coul CVE-2022-19574.3The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers CVE-2022-19586.5A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manip CVE-2022-19596.6AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because th CVE-2022-19604.3The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a l CVE-2022-19614.8The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4 CVE-2022-19625.5Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack e CVE-2022-19635.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 befor CVE-2022-19645.4The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Autho CVE-2022-19658.1Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly CVE-2022-19676.5The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perfo