CVE-2024-8124

Deeper analysis

CVE-2024-8124 is a denial-of-service vulnerability in GitLab Community Edition and Enterprise Edition. It affects all versions from 16.4 up to but not including 17.1.7, from 17.2 up to but not including 17.2.5, and from 17.3 up to but not including 17.3.2. The flaw, tracked under CWE-1333, can be triggered by a specially crafted POST request that exhausts server resources and produces a high availability impact according to its CVSS 7.5 score.

An unauthenticated attacker with network access can send the malicious POST request to induce the denial-of-service condition. No user interaction or credentials are required, allowing remote exploitation that disrupts GitLab service availability without affecting confidentiality or integrity.

GitLab addressed the issue in the September 2024 patch release covering versions 17.1.7, 17.2.5, and 17.3.2. Administrators are advised to upgrade to one of the fixed releases; the corresponding security issue and HackerOne report provide additional technical context for the fix.

The associated EPSS score reached a modest peak of 0.0584 and has since declined to 0.0455, indicating limited and non-persistent exploitation interest after disclosure.