CVE-2021-39914: 
GitLab vulnerability analysis and mitigation

A regular expression denial of service (ReDoS) vulnerability was identified in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3, and 14.4.0. The vulnerability was discovered internally by the GitLab team and was assigned CVE-2021-39914. The issue could trigger excessive resource usage when a specially crafted username was used during new user provisioning (GitLab Release).

The vulnerability stems from a problematic regular expression used in the namespace path cleaning functionality. The regex pattern was susceptible to backtracking issues when processing long malicious strings, which could cause the CPU to max out at 100% until the process was terminated. The issue was rated as low severity with a CVSS score of 3.1 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) (GitLab Release).

When exploited, this vulnerability could cause excessive CPU usage on the GitLab server. Repeated attacks could potentially tie up significant system resources, affecting the server's performance and availability (GitLab Issue).

The vulnerability was patched in GitLab versions 14.4.1, 14.3.4, and 14.2.6. Users are strongly recommended to upgrade to one of these versions or later to mitigate the issue (GitLab Release).