CVE-2024-4539

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-4539
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-4539.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-4539
Aliases
Downstream
Published
2024-05-09T01:38:21.737Z
Modified
2025-11-30T17:28:01.702322Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Allocation of Resources Without Limits or Throttling in GitLab
Details

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 where abusing the API to filter branch and tags could lead to Denial of Service.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4539.json",
    "cwe_ids": [
        "CWE-770"
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
abbda55531f0a9d630eee1dcf2305ca499c94116
Fixed
6878f253b7b50c8e6217ebfd03717b5e5ea960a4
Database specific 
{
    "versions": [
        {
            "introduced": "15.4"
        },
        {
            "fixed": "16.9.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
053df647320e7cac5c255f9e07264a0c35548409
Fixed
f5974fc8f24e7033135f5b0d4f77b68886b2e298
Database specific 
{
    "versions": [
        {
            "introduced": "16.10"
        },
        {
            "fixed": "16.10.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
22834294718a25956b0a859c8eed72248300eeee
Fixed
d210b947e3e51eebcbb24a9152f5c68f7e2b1d58
Database specific 
{
    "versions": [
        {
            "introduced": "16.11"
        },
        {
            "fixed": "16.11.2"
        }
    ]
}

Affected versions

v16.*

v16.10.0-ee
v16.10.1-ee
v16.10.2-ee
v16.10.3-ee
v16.10.4-ee
v16.11.0-ee
v16.11.1-ee

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-4539.json"