CVE-2024-1066

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-1066
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-1066.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-1066
Aliases
Downstream
Published
2024-02-07T22:02:11.043Z
Modified
2025-11-30T11:41:43.936077Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Allocation of Resources Without Limits or Throttling in GitLab
Details

An issue has been discovered in GitLab EE affecting all versions from 13.3.0 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 which allows an attacker to do a resource exhaustion using GraphQL vulnerabilitiesCountByDay

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1066.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
3e7758e0ac36a33f2b88aca3a313c9c5a33c8391
Fixed
df35a584380b571e113908bcd4d13e28a002aa09
Database specific 
{
    "versions": [
        {
            "introduced": "13.3.3"
        },
        {
            "fixed": "16.6.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
9e7d34f7ff11405ece06ec398b66965d153cee6f
Fixed
7f8d8e1af0b21cfdf58a4d00d5edb2c08dcfbc16
Database specific 
{
    "versions": [
        {
            "introduced": "16.7"
        },
        {
            "fixed": "16.7.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1e912d57d5a8f1135f4d41e25469069790134d41
Fixed
e3c23d67e9ce2f074cd79b753ef95291da459a93
Database specific 
{
    "versions": [
        {
            "introduced": "16.8"
        },
        {
            "fixed": "16.8.2"
        }
    ]
}

Affected versions

v16.*
v16.7.0-ee
v16.7.2-ee
v16.7.3-ee
v16.7.4-ee
v16.8.0-ee
v16.8.1-ee

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-1066.json"