CVE-2023-6159: Inefficient Regular Expression Complexity in GitLab

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-26 · updated 2026-06-17
Weakness: CWE-1333

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a `Cargo.toml` containing maliciously crafted input.

Affected products

GitLab: from 12.7.0 before 16.6.6; from 16.7.0 before 16.7.4; 16.8.0 — fixed in 16.6.6, 16.7.4

How to fix

Upgrade to a fixed version: GitLab 16.6.6, 16.7.4. Check the vendor advisory for mitigations.

References

https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/
https://gitlab.com/gitlab-org/gitlab/-/issues/431924
https://hackerone.com/reports/2251278
https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/
https://gitlab.com/gitlab-org/gitlab/-/issues/431924
https://hackerone.com/reports/2251278

Get alerted when CVE-2023-6159 or the next vulnerability affects your stack