What’s Vulnerable › Vulnerabilities
CVE-2023-6386: Allocation of Resources Without Limits or Throttling in GitLab
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-02-05 · updated 2026-06-17
- Weakness: CWE-770
Description
A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 which allows an attacker to spike the GitLab instance resource usage resulting in service degradation.
Affected products
- GitLab: from 15.11.0 before 16.6.7; from 16.7.0 before 16.7.5; from 16.8.0 before 16.8.2 — fixed in 16.6.7, 16.7.5, 16.8.2
How to fix
Upgrade to a fixed version: GitLab 16.6.7, 16.7.5, 16.8.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2023-6386 or the next vulnerability affects your stack