CVE-2022-1121: 
GitLab vulnerability analysis and mitigation

A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE was identified as CVE-2022-1121. The vulnerability affects all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2. This security issue was discovered and reported by researcher feistel (GitLab Release).

The vulnerability stems from missing appropriate timeout configurations in GitLab Pages, which could allow attackers to cause unlimited resource consumption. The issue has been assigned a CVSS v3.1 score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (NVD).

The vulnerability allows an attacker to cause unlimited resource consumption in GitLab Pages, potentially leading to denial of service conditions. This could affect the availability of GitLab Pages services for legitimate users (GitLab Release).

GitLab has addressed this vulnerability in versions 14.7.7, 14.8.5, and 14.9.2. Users are strongly recommended to upgrade to one of these patched versions immediately. GitLab.com was already running the patched version at the time of disclosure (GitLab Release).