CVE-2024-2800: 
GitLab vulnerability analysis and mitigation

A Regular expression Denial of Service (ReDoS) vulnerability was discovered in GitLab Enterprise Edition (EE) and Community Edition (CE) affecting branch name matching functionality using wildcards. The vulnerability affects all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. This security issue was reported through GitLab's HackerOne bug bounty program by researcher joaxcar (GitLab Release, CVE Details).

The vulnerability exists in the RefMatcher component when matching branch names that use wildcards. The issue allows for denial of service attacks through regex backtracking. The vulnerability has been assigned a CVSS v3.1 score of 6.5 (Medium severity) with the following vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (GitLab Release).

When successfully exploited, this vulnerability can lead to a denial of service condition through regex backtracking, potentially affecting the availability of the GitLab instance (GitLab Release).

The vulnerability requires low attack complexity and low privileges to exploit, with no user interaction needed. The attack can be initiated from the network (GitLab Release).

GitLab has released patches to address this vulnerability in versions 17.0.6, 17.1.4, and 17.2.2. Users are strongly recommended to upgrade their GitLab installations to one of these patched versions immediately. GitLab.com has already been updated with the necessary security fixes (GitLab Release).