CVE-2023-0921
Published: 06 June 2023
Summary
CVE-2023-0921 is a medium-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Gitlab Gitlab. Its CVSS base score is 4.3 (Medium).
Operationally, ranked in the top 4.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
GitLab Community Edition and Enterprise Edition contain a resource allocation flaw tracked as CVE-2023-0921 in all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2. The root cause is missing length validation on Issue descriptions submitted through the GraphQL API, which permits creation of arbitrarily large payloads that trigger repeated CPU saturation when fetched.
An authenticated attacker with standard user privileges can exploit the weakness by posting a single oversized Issue description and then issuing repeated GraphQL queries against it. The resulting CPU exhaustion produces a low-severity denial-of-service effect without requiring elevated access or user interaction, consistent with the reported CVSS 4.3 vector.
GitLab’s published advisories direct administrators to upgrade to 15.10.8, 15.11.7, or 16.0.2, where input-size checks were added to prevent oversized GraphQL payloads. The EPSS score rose from a low baseline to a recorded peak of 0.2146, indicating emerging exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-12908
Vulnerability details
A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU…
more
usage.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
This control implements explicit throttling on session allocation, addressing the weakness of allocating resources without limits.
Plan testing exercises resource allocation limits and throttling during simulated failures, directly addressing weaknesses that allow unbounded resource use.
Contingency plan updates ensure recovery strategies address unbounded resource allocation, making it harder for attackers to exploit lack of throttling to cause prolonged outages.
Provides continuity when unbounded resource allocation at the primary site leads to exhaustion and downtime.
Alternate services allow operations to continue when primary allocation of resources lacks limits or throttling.
Explicit planning of security-related actions requires defining limits, windows, and resource allocations, making allocation without throttling far less likely.
Measures of performance include tracking allocation behavior and throttling effectiveness, reducing the window for resource exhaustion attacks.
Imposes an inactivity-based limit on network resource allocation, throttling the number of concurrently held connections.