CVE-2020-26411

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-26411
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26411.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-26411
Aliases
Downstream
Published
2020-12-11T05:15:12.027Z
Modified
2026-03-14T02:14:57.217183Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
[none]
Details

A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2). Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused.

References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
e70802d39ca8751d0f167d736a34a39c1dc695bc
Fixed
f23895b2190f1d72d96ada15463ab8e20abead5b
Introduced
2f8ec2ebf58d8d4885127b9715b143e6756f2df1
Fixed
2e75f6e5b161b73e2ba28508c656854a66793d95
Introduced
c050e8fb184690b8c4cc4c2a5c233f312d713b09
Fixed
98aab73cbd597dab5b0f1ab4b40dc160b0d2e26f
Database specific 
{
    "versions": [
        {
            "introduced": "13.4.0"
        },
        {
            "fixed": "13.4.7"
        },
        {
            "introduced": "13.5.0"
        },
        {
            "fixed": "13.5.5"
        },
        {
            "introduced": "13.6.0"
        },
        {
            "fixed": "13.6.2"
        }
    ]
}

Affected versions

v13.*
v13.4.0-ee
v13.4.1-ee
v13.4.2-ee
v13.4.3-ee
v13.4.4-ee
v13.4.6-ee
v13.5.0-ee
v13.5.1-ee
v13.5.2-ee
v13.5.3-ee
v13.5.4-ee
v13.6.0-ee
v13.6.1-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26411.json"