CVE-2021-39880

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-39880
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39880.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-39880
Aliases
Downstream
Published
2021-10-05T15:15:07.727Z
Modified
2026-04-10T04:37:32.551766Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A Denial Of Service vulnerability in the apollouploadserver Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollouploadserver middleware.

References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e8824bdbcb70ab6210d3de565d52662d95c96978
Introduced
2f3536bdda88ae962d4f67ced68af6efd82254f1
Fixed
e8824bdbcb70ab6210d3de565d52662d95c96978
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
467d2cb7fe4aef65b5d0845e3aac3fb6b2b866a4
Introduced
e4567ef4362f4ef24a09112564b31dfe9044ea12
Fixed
467d2cb7fe4aef65b5d0845e3aac3fb6b2b866a4
Introduced
38bbb40bb77dd3e0f0281c4363e2ef298e650c42
Fixed
406469ced21f30ac40efcd98dad975802db778e9
Introduced
38bbb40bb77dd3e0f0281c4363e2ef298e650c42
Fixed
406469ced21f30ac40efcd98dad975802db778e9
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "14.0.9"
        },
        {
            "introduced": "11.9.0"
        },
        {
            "fixed": "14.0.9"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "14.1.4"
        },
        {
            "introduced": "14.1.0"
        },
        {
            "fixed": "14.1.4"
        },
        {
            "introduced": "14.2.0"
        },
        {
            "fixed": "14.2.2"
        },
        {
            "introduced": "14.2.0"
        },
        {
            "fixed": "14.2.2"
        }
    ]
}

Affected versions

Other
11-10-0cfa69752d8-0d9531c80-ee
11-10-0cfa69752d8-74ffd66ae-ee
11-10-119f9509d50-6d7537235-ee
v1.*
v1.2.0
v1.2.0pre
v1.2.1
v1.2.2
v14.*
v14.0.0-ee
v14.0.0-rc42-ee
v14.0.0-rc43-ee
v14.0.0-rc44-ee
v14.0.1-ee
v14.0.3-ee
v14.0.5-ee
v14.0.6-ee
v14.0.8-ee
v14.1.0-ee
v14.1.1-ee
v14.1.3-ee
v14.2.0-ee
v14.2.1-ee
v2.*
v2.3.0
v2.3.0pre
v2.3.1
v2.4.0
v2.4.0pre
v2.4.1
v2.5.0
v2.6.0
v2.6.0pre
v2.6.1
v2.6.2
v2.6.3
v2.7.0
v2.7.0pre
v2.8.0
v2.8.0pre
v2.8.1
v2.8.2
v2.9.0
v2.9.1
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v4.*
v4.0.0
v4.0.0rc1
v4.0.0rc2
v5.*
v5.0.0
v5.1.0
v5.2.0
v6.*
v6.0.0-ee
v6.0.0-ee.beta
v6.0.0-ee.rc1
v6.1.0-ee
v6.3.0-ee
v6.3.1-ee
v6.4.0-ee
v6.5.0-ee
v6.6.0-ee
v6.7.0-ee
v6.7.0.rc1-ee
v6.8.0-ee
v7.*
v7.0.0-ee
v7.1.0-ee
v7.1.0.rc1-ee
v7.2.0.rc1-ee
v7.2.0.rc2-ee
v7.2.0.rc3-ee
v7.2.0.rc4-ee
v7.2.0.rc5-ee
v7.3.0-ee
v7.3.0.rc1-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39880.json"