CVE-2024-4539
📋 TL;DR
This vulnerability in GitLab allows attackers to cause Denial of Service by abusing API endpoints that filter branches and tags. All GitLab CE/EE instances within affected version ranges are vulnerable, potentially disrupting service availability.
💻 Affected Systems
- GitLab Community Edition
- GitLab Enterprise Edition
📦 What is this software?
Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →Gitlab by Gitlab
GitLab is a complete DevOps platform providing source code management, CI/CD pipelines, security scanning, container registry, and collaboration tools used by millions of developers and thousands of enterprises worldwide. As both a cloud-hosted SaaS offering (GitLab.com) and self-managed software, G...
Learn more about Gitlab →⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability for GitLab instance, preventing code repository access, CI/CD pipelines, and collaboration features.
Likely Case
Degraded performance or temporary service disruption affecting specific projects or users.
If Mitigated
Minimal impact with proper rate limiting, API access controls, and monitoring in place.
🎯 Exploit Status
Requires API access but exploitation appears straightforward based on CWE-770 (Allocation of Resources Without Limits or Throttling).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.9.7, 16.10.5, or 16.11.2
Vendor Advisory: https://gitlab.com/gitlab-org/gitlab/-/issues/454815
Restart Required: Yes
Instructions:
1. Backup your GitLab instance. 2. Update to patched version: 16.9.7, 16.10.5, or 16.11.2. 3. Restart GitLab services. 4. Verify update completed successfully.
🔧 Temporary Workarounds
Rate Limit API Endpoints
allImplement rate limiting on branch/tag filtering API endpoints to prevent abuse.
Configure in GitLab admin settings or via reverse proxy (nginx/apache) rate limiting rules
Restrict API Access
allLimit API access to trusted users/IPs only.
Configure firewall rules or GitLab application-level access controls
🧯 If You Can't Patch
- Implement strict API rate limiting and monitoring
- Restrict API access to minimal required users and IP addresses
🔍 How to Verify
Check if Vulnerable:
Check GitLab version via admin interface or command: sudo gitlab-rake gitlab:env:infoCheck Version:
sudo gitlab-rake gitlab:env:info | grep 'Version:'Verify Fix Applied:
Confirm version is 16.9.7+, 16.10.5+, or 16.11.2+ and test API filtering functionality📡 Detection & Monitoring
Log Indicators:
- Unusual high volume of API requests to branch/tag filtering endpoints
- Error logs indicating resource exhaustion
Network Indicators:
- Spike in API traffic patterns
- Abnormal request rates to /api/v4/projects/*/repository/branches or similar endpoints
SIEM Query:
source="gitlab" AND (uri_path="/api/v4/projects/*/repository/branches" OR uri_path="/api/v4/projects/*/repository/tags") | stats count by src_ip