CVE-2024-4539

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 where abusing the API to filter branch and tags could lead to Denial of Service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
May 14, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-453909.8@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if theCVE-2024-453917.5Tina is an open-source content management system (CMS). Sites building with Tina CMS's command line interface (CLI) prior to version 1.6.2 tCVE-2024-453924.3SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control cheCVE-2024-453936.4Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with a CVAT accounCVE-2024-453947.8Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data CVE-2024-453957.5sigstore-go, a Go library for Sigstore signing and verification, is susceptible to a denial of service attack in versions prior to 0.6.1 wheCVE-2024-453967.5Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attackerCVE-2024-453977.5h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open orCVE-2024-453988.8Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute thCVE-2024-453996.1Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version CVE-2024-45407.5A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plainCVE-2024-454006.1ckeditor-plugin-openlink is a plugin for the CKEditor JavaScript text editor that extends the context menu with a possibility to open a link
CVE-2024-4539: Medium severity, CVSS 6.5 | Vulnix