Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-2592 EUVD-2022-34840GHSA-4x6r-28wm-339v

A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 p…

Published Oct 17, 2022 · Updated May 13, 2025 · Assigned by GitLab

Description

A lack of length validation in Snippet descriptions in GitLab CE/EE affecting all versions prior to 15.1.6, 15.2 prior to 15.2.4 and 15.3 prior to 15.3.2 allows an authenticated attacker to create a maliciously large Snippet which when requested with or without authentication places excessive load on the server, potential leading to Denial of Service.

Affected products

VendorProductAffectedFixed
GitLab GitLab >=12.9.8, <15.1.6, >=15.2, <15.2.4, >=15.3, <15.3.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS gitlab No fix yet —

References