CVE-2023-6386

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-6386
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6386.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-6386
Aliases
Downstream
Published
2025-02-05T09:31:10.106Z
Modified
2025-12-05T04:02:34.723552Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Allocation of Resources Without Limits or Throttling in GitLab
Details

A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 which allows an attacker to spike the GitLab instance resource usage resulting in service degradation.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6386.json",
    "cwe_ids": [
        "CWE-770"
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
4dce6bc3728f63bc9086ff3088cda7527f6f0bec
Fixed
df35a584380b571e113908bcd4d13e28a002aa09
Database specific 
{
    "versions": [
        {
            "introduced": "15.11"
        },
        {
            "fixed": "16.6.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
9e7d34f7ff11405ece06ec398b66965d153cee6f
Fixed
7f8d8e1af0b21cfdf58a4d00d5edb2c08dcfbc16
Database specific 
{
    "versions": [
        {
            "introduced": "16.7"
        },
        {
            "fixed": "16.7.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1e912d57d5a8f1135f4d41e25469069790134d41
Fixed
e3c23d67e9ce2f074cd79b753ef95291da459a93
Database specific 
{
    "versions": [
        {
            "introduced": "16.8"
        },
        {
            "fixed": "16.8.2"
        }
    ]
}

Affected versions

v16.*

v16.7.0-ee
v16.7.2-ee
v16.7.3-ee
v16.7.4-ee
v16.8.0-ee
v16.8.1-ee