CVE-2023-6489

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-6489
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6489.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-6489
Aliases
Downstream
Published
2024-04-12T00:53:41.230Z
Modified
2025-12-05T04:06:54.412331Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Inefficient Regular Expression Complexity in GitLab
Details

A denial of service vulnerability was identified in GitLab CE/EE, versions 16.7.7 prior to 16.8.6, 16.9 prior to 16.9.4 and 16.10 prior to 16.10.2 which allows an attacker to spike the GitLab instance resources usage resulting in service degradation via chat integration feature.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6489.json",
    "cwe_ids": [
        "CWE-1333"
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
8d2bc7e01afa79a3bd9c40298c6d41a9c68be2a0
Fixed
413f2c727d9beff69c9568e2d83f460dee1fdce1
Database specific 
{
    "versions": [
        {
            "introduced": "16.7.7"
        },
        {
            "fixed": "16.8.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
76326ae8b898b38c8217ad037ed7122be00e62f0
Fixed
6eb4afb360544806d6a3dc4157acdb09eb279247
Database specific 
{
    "versions": [
        {
            "introduced": "16.9"
        },
        {
            "fixed": "16.9.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
053df647320e7cac5c255f9e07264a0c35548409
Fixed
0be71eb07fff4e6edd559cf8b4bdfaebe602e58d
Database specific 
{
    "versions": [
        {
            "introduced": "16.10"
        },
        {
            "fixed": "16.10.2"
        }
    ]
}

Affected versions

v16.*

v16.10.0-ee
v16.10.1-ee
v16.9.0-ee
v16.9.0-rc44-ee
v16.9.1-ee
v16.9.2-ee
v16.9.3-ee