CVE-2024-10307: GitLab Denial of Service Vulnerability

CVE-2024-10307 Overview

CVE-2024-10307 is an uncontrolled resource consumption vulnerability [CWE-770] affecting GitLab Community Edition (CE) and Enterprise Edition (EE). The flaw impacts all versions from 12.10 before 17.8.6, versions 17.9 before 17.9.3, and versions 17.10 before 17.10.1. A maliciously crafted file triggers uncontrolled CPU consumption when a user views the associated merge request. The vulnerability requires user interaction and is scoped to availability impact only.

Critical Impact
Attackers with the ability to push a crafted file to a merge request can exhaust CPU resources on the GitLab instance, degrading availability for legitimate users.

Affected Products

GitLab CE/EE versions 12.10 through 17.8.5
GitLab CE/EE versions 17.9 through 17.9.2
GitLab CE/EE version 17.10.0

Discovery Timeline

2025-03-28 - CVE-2024-10307 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10307

Vulnerability Analysis

The vulnerability resides in GitLab's merge request file viewing logic. When a user opens a merge request that contains a maliciously crafted file, the rendering or diffing routine performs computation that scales in a way the attacker can control. This produces sustained CPU exhaustion on the server-side process handling the view request.

The issue maps to [CWE-770: Allocation of Resources Without Limits or Throttling]. GitLab does not adequately bound the processing cost per merge request file, allowing a single crafted input to consume disproportionate compute resources. Public advisory details are tracked in GitLab Issue #500497 and HackerOne Report #2775113.

Root Cause

The root cause is missing input-size or algorithmic-complexity throttling in the merge request file rendering path. Certain file structures cause the parser or diff engine to enter expensive execution states. Because the operation runs synchronously when a user views the merge request, each view triggers full processing cost.

Attack Vector

An authenticated user who can contribute to a repository pushes a crafted file into a branch and opens a merge request. Any user who views that merge request causes the server to consume excessive CPU. The attack vector is local per the CVSS metrics, requires no privileges to trigger the payload, and depends on user interaction (viewing the merge request). Impact is limited to availability, with no confidentiality or integrity effect.

No verified proof-of-concept code is publicly available. Technical details are described in the linked HackerOne report and GitLab issue.

Detection Methods for CVE-2024-10307

Indicators of Compromise

Sustained high CPU utilization on GitLab Rails or Sidekiq workers correlated with specific merge request view requests.
Web request logs showing repeated GET requests to /-/merge_requests/*/diffs endpoints followed by process timeouts.
Unusually large or structurally anomalous files added to recent merge requests.

Detection Strategies

Correlate GitLab application logs with host-level CPU telemetry to identify merge request URLs that consistently drive worker saturation.
Alert on Rails request durations that exceed baseline thresholds for merge request diff endpoints.
Review merge requests submitted by low-reputation or newly created accounts for files with unusual size, encoding, or nesting.

Monitoring Recommendations

Enable and forward production_json.log and api_json.log from GitLab for centralized analysis of slow requests.
Track Puma and Sidekiq worker restart events, which may indicate timeout kills triggered by resource exhaustion.
Monitor merge request creation velocity and file characteristics from external contributors on public projects.

How to Mitigate CVE-2024-10307

Immediate Actions Required

Upgrade GitLab CE/EE to 17.8.6, 17.9.3, or 17.10.1 as appropriate for your release track.
Restrict merge request submission on public projects to trusted contributors until patched.
Review recent merge requests for suspicious files and close or revert those from untrusted sources.

Patch Information

GitLab addressed the vulnerability in versions 17.8.6, 17.9.3, and 17.10.1. Administrators should apply the latest patch release for their deployed branch. Reference the GitLab Issue #500497 tracker for the fix commit and release notes.

Workarounds

Limit repository write access to vetted users on internet-facing GitLab instances until upgrade.
Configure request timeouts on the Puma web server and reverse proxy to bound the impact of expensive merge request views.
Enforce file-size and content-type restrictions at the CI/CD or pre-receive hook layer to reject anomalous inputs.

bash

# Example: enforce request timeout in gitlab.rb to cap long-running views
gitlab_rails['env'] = {
  'PUMA_WORKER_TIMEOUT' => '30'
}
# Apply configuration
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart puma