{"id":"CVE-2023-6489","state":"PUBLISHED","title":"Inefficient Regular Expression Complexity in GitLab","description":"A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.","publishedAt":"2024-04-12T00:53:41.230Z","updatedAt":"2026-08-14T04:14:23.653Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","source":"GitLab"},"assigner":"GitLab","products":["GitLab GitLab"],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"16.7.7","status":"affected","lessThan":"16.8.6","versionType":"semver"},{"version":"16.9","status":"affected","lessThan":"16.9.4","versionType":"semver"},{"version":"16.10","status":"affected","lessThan":"16.10.2","versionType":"semver"}],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"]}],"references":["https://gitlab.com/gitlab-org/gitlab/-/issues/433520","https://hackerone.com/reports/2262450"],"weaknesses":["CWE-1333"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/6xxx/CVE-2023-6489.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-6489","state":"PUBLISHED","datePublished":"2024-04-12T00:53:41.230Z","dateUpdated":"2026-08-14T04:14:23.653Z","assignerShortName":"GitLab","assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateReserved":"2023-12-04T16:30:20.261Z"},"containers":{"cna":{"title":"Inefficient Regular Expression Complexity in GitLab","descriptions":[{"lang":"en","value":"A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature."}],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"16.7.7","status":"affected","lessThan":"16.8.6","versionType":"semver"},{"version":"16.9","status":"affected","lessThan":"16.9.4","versionType":"semver"},{"version":"16.10","status":"affected","lessThan":"16.10.2","versionType":"semver"}],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"]}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/433520","name":"GitLab Issue #433520","tags":["issue-tracking","permissions-required"]},{"url":"https://hackerone.com/reports/2262450","name":"HackerOne Bug Bounty Report #2262450","tags":["technical-description","exploit","permissions-required","broken-link"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW","baseScore":4.3,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1333","lang":"en","description":"CWE-1333: Inefficient Regular Expression Complexity","type":"CWE"}]}],"providerMetadata":{"shortName":"GitLab","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateUpdated":"2026-08-14T04:14:23.653Z"},"solutions":[{"lang":"en","value":"Upgrade to versions 16.8.6, 16.9.4, 16.10.2 or above."}],"credits":[{"lang":"en","value":"Thanks `Anonymizer` for reporting this vulnerability through our HackerOne bug bounty program","type":"finder"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-08T18:45:14.622510Z","id":"CVE-2023-6489","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-08T20:13:28.175Z"}},{"title":"CVE Program Container","references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/433520","name":"GitLab Issue #433520","tags":["issue-tracking","permissions-required","x_transferred"]},{"url":"https://hackerone.com/reports/2262450","name":"HackerOne Bug Bounty Report #2262450","tags":["technical-description","exploit","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T08:28:21.821Z"}}]}}}