An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11…

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A Regular Expression Denial of Service was possible via sending crafted payloads to the preview_markdown endpoint.

Scores

EPSS (exploitation in 30 days)

1.3% · top 29% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• Uncontrolled resource consumption in GitLab
• CWE-1333 Inefficient Regular Expression Complexity (opens in a new tab)All about CWE-1333 and its CVEs

Affected products

• GitLab · GitLab

  • affected >=12.0, <15.10.8
  • affected >=15.11, <15.11.7
  • affected >=16.0, <16.0.2

References (3)

• https://gitlab.com/gitlab-org/gitlab/-/issues/408272 (opens in a new tab)x_transferredexploit
• https://hackerone.com/reports/1943819 (opens in a new tab)x_transferred
• https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-2199.json (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-2199](https://trackcve.app/badge/CVE-2023-2199.svg)](https://trackcve.app/cve/CVE-2023-2199)

Record last updated 7 Jan 2025, 16:45 UTC.