CVE-2022-3639: 
GitLab vulnerability analysis and mitigation

A potential Denial of Service (DoS) vulnerability was discovered in GitLab CE/EE affecting all versions from 10.8 before 15.1.6, all versions starting from 15.2 before 15.2.4, and all versions starting from 15.3 before 15.3.2. The vulnerability was assigned identifier CVE-2022-3639 and was disclosed on October 21, 2022 (CVE Details).

The vulnerability exists in the /issues/{issue_number}/can_create_branch endpoint where improper data handling on branch creation could trigger high CPU usage. The endpoint enters into a loop performing thousands of git operations per request, which could lead to resource exhaustion on the host (GitLab Issue).

When exploited, this vulnerability allows an authenticated attacker to cause resource exhaustion on the GitLab server through multiple requests to the affected endpoint. The vulnerability has a CVSSv3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating a high impact on system availability (GitLab Issue).

GitLab has addressed this vulnerability in versions 15.1.6, 15.2.4, and 15.3.2. Users should upgrade to these or later versions to protect against this vulnerability (CVE Details).