Technical impact
GitLab Community Edition and Enterprise Edition contain a flaw that lets an unauthenticated user send specially crafted requests to the Jira events endpoint. The flaw causes the system to allocate resources without any limits or throttling, allowing the attacker to exhaust server resources and disrupt legitimate traffic. The primary impact is a denial of service to all users who rely on the affected GitLab instance.
Affected Systems
All supported GitLab Community Edition releases from 14.4 up to, but not including, 18.7.5, all Enterprise Edition releases from 14.4 up to, but not including, 18.7.5, the 18.8 series before 18.8.5, and the 18.9 series before 18.9.1 are affected. The issue applies to both community and enterprise editions and triggers when the Jira events API is called by an unauthenticated user.
Risk and Exploitability
The vulnerability carries a CVSS score of 7.5, indicating high severity, while the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. An attacker can exploit it over the network by sending crafted HTTP POST requests to the Jira events endpoint without authentication. Successful exploitation can result in resource exhaustion and service interruption for all users of the GitLab instance.
