Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2023-6502: GitLab allows wiki page to crash server
CVE-2023-6502 · published 2 years ago
Summary
GitLab versions before 16.10.6, 16.11.3, and 17.0.1 can be made to stop responding if someone creates a specially crafted wiki page. The problem arises from a slow‑running text filter that ties up the system. Update GitLab to the latest release or apply the provided patch to stop the issue.
What to do
- Update gitlab to version 17.0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | gitlab |
>= 17.0.0, < 17.0.1 Fix: upgrade to 17.0.1
|
| – | gitlab | gitlab |
< 16.10.6 >= 16.11.0, < 16.11.3 17.0.0 cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
Original advisory text
Inefficient Regular Expression Complexity in GitLab
A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. It is possible for an attacker to cause a denial of service using a crafted wiki page.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6502.j... Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/433534 Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-6502 Vendor Advisory
- https://hackerone.com/reports/2263638 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published23 May 2024
Updated4 Nov 2026
First seen14 Aug 2026
Track software like this
Free during beta