Vulnerability · Published Nov 4, 2021 · Assigned by GitLab

CVE-2021-39914

Low 3.1

In plain English

A low-severity security flaw in GitLab from GitLab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)1.2%top 31.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A regular expression denial of service issue in GitLab versions 8.13 to 14.2.5, 14.3.0 to 14.3.3 and 14.4.0 could cause excessive usage of resources when a specially crafted username was used when provisioning a new user

Affected products (as reported)

Vendor	Product	Versions
GitLab	GitLab	>=8.13, <14.2.6>=14.3.0, <14.3.4>=14.4.0, <14.4.1

References

https://gitlab.com/gitlab-org/gitlab/-/issues/289948 x_refsource_MISC
https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39914.json x_refsource_CONFIRM