A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2…

Description

A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit message field.

Scores

EPSS (exploitation in 30 days)

1.2% · top 32% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• Uncontrolled resource consumption in GitLab
• CWE-1333 Inefficient Regular Expression Complexity (opens in a new tab)All about CWE-1333 and its CVEs

Affected products

• GitLab · GitLab

  • affected >=10.7, <15.1.5
  • affected >=15.2, <15.2.3
  • affected >=15.3, <15.3.1

References (3)

• https://gitlab.com/gitlab-org/gitlab/-/issues/363734 (opens in a new tab)x_transferredexploit
• https://hackerone.com/reports/1584156 (opens in a new tab)x_transferred
• https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2908.json (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2022-2908](https://trackcve.app/badge/CVE-2022-2908.svg)](https://trackcve.app/cve/CVE-2022-2908)

Record last updated 13 May 2025, 19:10 UTC.