CVE-2023-3994
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
An issue has been discovered in GitLab CE/EE affecting all versions from 9.3 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.
Risk Assessment
An attacker could exploit this vulnerability to cause a denial of service, potentially leading to downtime and loss of availability for users.
Recommendation
It is recommended to update GitLab CE/EE to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Other vulnerabilities in GitLab CE/EE
See all- CVE-2026-1659High
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation.
- CVE-2025-14870High
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an unauthenticated user to cause denial of service by sending specially crafted JSON payloads due to insufficient input validation.
- CVE-2025-14869High
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3. This issue could have allowed an unauthenticated user to cause denial of service by sending specially crafted payloads on certain API endpoints.
- CVE-2023-3364High
An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. A Denial of Service (DoS) attack was possible via crafted payloads using AutolinkFilter at the preview_markdown endpoint.
- CVE-2026-6336Medium
A missing authorization check in GitLab CE/EE allows an unauthorized user to view project import source information. Affected versions are from 16.6 to 19.0.4, 19.1 to 19.1.2, and 19.2 to 19.2.0.
- CVE-2025-14562Low
GitLab CE/EE has improper authorization checks on merge request collaboration settings, allowing an authenticated user with developer role to commit changes to a project after being removed as a member. Affected versions are 10.6 through 19.0.4, 19.1 through 19.1.2, and 19.2 through 19.2.0.
- CVE-2026-2238Medium
A vulnerability in GitLab CE/EE allowed an unauthenticated user to view confidential issue references in public projects under certain conditions due to improper authorization checks. Affected versions: 17.5 to 18.11.6, 19.0 to 19.0.3, and 19.1 to 19.1.1.
- CVE-2026-1606Medium
A vulnerability in GitLab CE/EE allows an authenticated user to conceal content within a Snippet due to improper input validation. The issue affects versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1.
- CVE-2026-12635Unknown
A vulnerability in GitLab CE/EE allows an authenticated user with maintainer role to make requests to internal network resources via mirror synchronization due to improper URL validation. Affected versions: from 8.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1.
- CVE-2026-10712High
A vulnerability in GitLab CE/EE allows an unauthenticated attacker to execute arbitrary JavaScript in a user's browser session due to improper path validation. Affects versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1.
Original NVD description (English source)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A Regular Expression Denial of Service was possible via sending crafted payloads which use ProjectReferenceFilter to the preview_markdown endpoint.