CVE-2021-22197: 
GitLab vulnerability analysis and mitigation

An infinite loop vulnerability was discovered in GitLab CE/EE affecting all versions starting from 10.6. The issue occurs when an authenticated user with specific rights accesses a Merge Request (MR) where the source and target branches point to each other. This vulnerability was discovered internally by the GitLab team and was assigned CVE-2021-22197 (GitLab Release).

The vulnerability is classified as a Loop with Unreachable Exit Condition (Infinite Loop) under CWE-835. It received a CVSS v3.1 Base Score of 3.5 (LOW) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L from GitLab Inc., while the NVD assessment rated it at 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L (NVD).

The vulnerability affects system availability by causing an infinite loop when specific conditions are met in merge request operations. The impact is limited to authenticated users with specific rights, potentially causing resource consumption and affecting system performance (GitLab Release).

The vulnerability was addressed in GitLab security releases 13.10.1, 13.9.5, and 13.8.7. GitLab strongly recommends that all installations running affected versions be upgraded to the latest version as soon as possible (GitLab Release).