CVE-2024-3114

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the processing logic for parsing invalid commits can lead to a regular expression DoS attack on the server.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 11.10, < 17.0.6; >= 17.1, < 17.1.4; >= 17.2, < 17.2.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/452547Broken Link
https://hackerone.com/reports/2416630Permissions Required

Timeline

Published: Aug 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-311404.9In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools CVE-2024-311416.5Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clie CVE-2024-311427.5Because of a logical error in XSA-407 (Branch Type Confusion), the mitigation is not applied properly when it is intended to be used. XSA-43 CVE-2024-311437.5An optional feature of PCI MSI called "Multiple Message" allows a device to use multiple consecutive interrupt vectors. Unlike for MSI-X, t CVE-2024-311443.8For a brief summary of Xapi terminology, see: https://xapi-project.github.io/xen-api/overview.html#object-model-overview Xapi contains CVE-2024-311457.5Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel CVE-2024-311467.5When multiple devices share resources and one of them is to be passed through to a guest, security of the entire system and of respective gu CVE-2024-31154.3An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and sta CVE-2024-311503.8Out-of-bounds read for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable information disclosure v CVE-2024-311519.8A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the CVE-2024-311527.5The LevelOne WBR-6012 router with firmware R0.40e6 is vulnerable to improper resource allocation within its web application, where a series CVE-2024-311535.5Improper input validation for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentia