CVE-2023-3917

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1287

Affected software

Vendor	Product	Versions
GitLab	GitLab	< 16.2.8; >= 16.3, < 16.3.5; >= 16.4, < 16.4.1

References

https://gitlab.com/gitlab-org/gitlab/-/issues/417896Broken Link
https://hackerone.com/reports/2055158Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/417896Broken Link
https://hackerone.com/reports/2055158Permissions Required

Timeline

Published: Sep 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-391717.2SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.CVE-2023-391729.1The affected devices transmit sensitive information unencrypted allowing a remote unauthenticated attacker to capture and modify network tra CVE-2023-391738.8In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account access CVE-2023-391747.5In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackers CVE-2023-391756.1In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible CVE-2023-391767.5A flaw was found within the parsing of SMB2 requests that have a transform header in the kernel ksmbd module. The issue results from the lac CVE-2023-391797.5A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation CVE-2023-391807.5A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its CVE-2023-391817.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected application contains an out of bound CVE-2023-391827.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bound CVE-2023-391837.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bound CVE-2023-391847.8A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 7). The affected applications contain an out of bound