Description
An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 that could have allowed an authenticated user to create a denial-of-service condition by exploiting an unprotected GraphQL API through repeated requests.
Problem types
CWE-770: Allocation of Resources Without Limits or Throttling
Product status
18.1 before 18.2.7
18.3 before 18.3.3
18.4 before 18.4.1
Credits
This vulnerability has been discovered internally by GitLab team member Terri Chu
References
gitlab.com/gitlab-org/gitlab/-/issues/517757 (GitLab Issue #517757)
