CVE-2024-9367

An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while parsing templates to generate changelogs.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/496631	Exploit Issue Tracking Vendor Advisory
https://hackerone.com/reports/2735311	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

11 Jul 2025, 19:30

Type	Values Removed	Values Added
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/496631 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/496631 - Exploit, Issue Tracking, Vendor Advisory
References	~~() https://hackerone.com/reports/2735311 -~~	() https://hackerone.com/reports/2735311 - Permissions Required
Summary		(es) Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde la 13.9 hasta la 17.4.6, la 17.5 hasta la 17.5.4 y la 17.6 hasta la 17.6.2, que permite a un atacante provocar un consumo descontrolado de CPU, lo que podría provocar una condición de denegación de servicio (DoS) al analizar plantillas para generar registros de cambios.
First Time		Gitlab Gitlab gitlab
CPE		cpe:2.3:a:gitlab:gitlab:::::enterprise:::* cpe:2.3:a:gitlab:gitlab:::::community:::*

12 Dec 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-12 12:15

Updated : 2025-07-11 19:30

NVD link : CVE-2024-9367

Mitre link : CVE-2024-9367

CVE.ORG link : CVE-2024-9367

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2024-9367", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-12-12T12:15:28.497", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/496631", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/2735311", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2, that allows an attacker to cause uncontrolled CPU consumption, potentially leading to a Denial of Service (DoS) condition while parsing templates to generate changelogs."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en GitLab CE/EE que afecta a todas las versiones desde la 13.9 hasta la 17.4.6, la 17.5 hasta la 17.5.4 y la 17.6 hasta la 17.6.2, que permite a un atacante provocar un consumo descontrolado de CPU, lo que podr\u00eda provocar una condici\u00f3n de denegaci\u00f3n de servicio (DoS) al analizar plantillas para generar registros de cambios."}], "lastModified": "2025-07-11T19:30:27.460", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "F2E4E4EB-7E6A-4780-8C9A-DFDAEE3E5D87", "versionEndExcluding": "17.4.6", "versionStartIncluding": "13.9.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "0A91C9BA-5D3C-4D62-9346-06AD4ED5B71C", "versionEndExcluding": "17.4.6", "versionStartIncluding": "13.9.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "1587202E-2392-46F3-BE79-00BE065AD2AE", "versionEndExcluding": "17.5.4", "versionStartIncluding": "17.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "0A13BB0D-E1E4-4C0B-A823-E661591D4E4F", "versionEndExcluding": "17.5.4", "versionStartIncluding": "17.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "1E994AE4-0E47-4CF0-93B2-C28A5E274059", "versionEndExcluding": "17.6.2", "versionStartIncluding": "17.6.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "01C8A373-615F-45FE-8AF7-BB053EC77D82", "versionEndExcluding": "17.6.2", "versionStartIncluding": "17.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}