CVE-2021-39877: 
GitLab vulnerability analysis and mitigation

A vulnerability was discovered in GitLab starting with version 12.2 that allows an attacker to cause uncontrolled resource consumption with a specially crafted file. The vulnerability was assigned CVE-2021-39877 and was reported through GitLab's HackerOne bug bounty program (GitLab Release, CVE Mitre).

The vulnerability is related to the Markdown parser functionality in GitLab. When a specially crafted Markdown file is uploaded to a repository and viewed in the browser, it can cause the server to consume 100% CPU usage for more than half a minute in the particular CPU core that handles the job. The issue has a CVSS score of 7.7 (High) with the vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H (GitLab Release).

When multiple users attempt to view the malicious Markdown file simultaneously, all CPU cores can be occupied, leading to a denial-of-service condition. This can make the GitLab server and its services completely unavailable. The vulnerability is particularly impactful as it can be triggered without user authentication if the repository is set as publicly accessible (GitLab Issue).

The vulnerability was patched in GitLab security releases 14.3.1, 14.2.5, and 14.1.7. GitLab strongly recommends that all installations running affected versions be upgraded to the latest version as soon as possible (GitLab Release).