CVE-2022-2931

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. Malformed content added to the issue description could have been used to trigger high CPU usage.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
GitLab	GitLab	<15.1.6; >=15.2, <15.2.4; >=15.3, <15.3.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2931.jsonThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/361982Third Party Advisory
https://hackerone.com/reports/1543718Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2931.jsonThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/361982Third Party Advisory
https://hackerone.com/reports/1543718Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/361982Third Party Advisory

Timeline

Published: Oct 17, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-293158.8Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used.CVE-2022-293169.8Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=result&searchfor=advanc CVE-2022-293179.8Simple Bus Ticket Booking System v1.0 was discovered to contain multiple SQL injection vulnerbilities via the username and password paramete CVE-2022-293187.2An arbitrary file upload vulnerability in the New Entry module of Car Rental Management System v1.0 allows attackers to execute arbitrary co CVE-2022-29326.1Cross-site Scripting (XSS) - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2.CVE-2022-293207.8MiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.CVE-2022-293219.8D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the lanip parameter in /goform/setNetworkLan.CVE-2022-293229.8D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the IPADDR and nvmacaddr parameters in /goform/form2Dhcpip.CVE-2022-293239.8D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the MAC parameter in /goform/editassignment.CVE-2022-293249.8D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the proto parameter in /goform/form2IPQoSTcAdd.CVE-2022-293259.8D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the addurlfilter parameter in /goform/websURLFilter.CVE-2022-293269.8D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the addhostfilter parameter in /goform/websHostFilter.