CVE-2024-2454
Published: 14 May 2024
Summary
CVE-2024-2454 is a medium-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Gitlab Gitlab. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 18.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-2454 is a denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition. It affects all versions from 15.11 prior to 16.9.7, from 16.10 prior to 16.10.5, and from 16.11 prior to 16.11.2. The flaw resides in the pins endpoint, which can be abused via a crafted request to trigger resource exhaustion, corresponding to CWE-770 and carrying a CVSS 3.1 score of 6.5.
An authenticated attacker with low-privileged network access can send a specially formed request to the pins endpoint, resulting in high availability impact without affecting confidentiality or integrity. The attack requires no user interaction and can be performed remotely over the network.
Public references, including the GitLab issue tracker and associated HackerOne reports, point to the availability of patched releases that remediate the issue by updating to the fixed versions listed above.
EPSS for this CVE rose from a low baseline to a peak of 0.0887 on 2025-12-11 before receding to the current value of 0.0156, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27403
Vulnerability details
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. The pins endpoint is susceptible to DoS through a crafted…
more
request.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
This control implements explicit throttling on session allocation, addressing the weakness of allocating resources without limits.
Plan testing exercises resource allocation limits and throttling during simulated failures, directly addressing weaknesses that allow unbounded resource use.
Contingency plan updates ensure recovery strategies address unbounded resource allocation, making it harder for attackers to exploit lack of throttling to cause prolonged outages.
Provides continuity when unbounded resource allocation at the primary site leads to exhaustion and downtime.
Alternate services allow operations to continue when primary allocation of resources lacks limits or throttling.
Explicit planning of security-related actions requires defining limits, windows, and resource allocations, making allocation without throttling far less likely.
Measures of performance include tracking allocation behavior and throttling effectiveness, reducing the window for resource exhaustion attacks.
Imposes an inactivity-based limit on network resource allocation, throttling the number of concurrently held connections.