CVE-2023-3205: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, and all versions starting from 16.3 before 16.3.1. The vulnerability allows an authenticated user to trigger a denial of service when importing or cloning malicious content (GitLab Advisory, NVD).

The vulnerability is related to inefficient regular expression complexity (CWE-1333) in the bulk import API. The regex used to validate the destination_namespace parameter is vulnerable to catastrophic backtracking issues, particularly when processing strings containing long sequences of alphanumeric characters ending in a non-alphanumeric character. The vulnerability has a CVSS v3.1 base score of 6.5 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (GitLab Issue, NVD).

When exploited, this vulnerability can cause a denial of service by consuming excessive CPU resources. Testing showed that just 10 malicious API calls could significantly impact server performance, causing response times to increase to around 1 minute for loading the front page of GitLab (GitLab Issue).

The vulnerability has been fixed in GitLab versions 16.1.5, 16.2.5, and 16.3.1. Users are strongly recommended to upgrade to one of these patched versions immediately (GitLab Advisory).