CVE-2024-9631: GitLab Merge Request DoS Vulnerability

CVE-2024-9631 Overview

A denial of service vulnerability has been discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) affecting all versions starting from 13.6. The vulnerability allows unauthenticated attackers to cause significant performance degradation when viewing merge request diffs that contain conflicts. This algorithmic complexity issue can lead to service unavailability, impacting the availability of GitLab instances.

Critical Impact

Unauthenticated attackers can trigger denial of service conditions by exploiting inefficient processing of merge request diffs with conflicts, potentially making GitLab instances unresponsive.

Affected Products

• GitLab Community Edition (CE) versions 13.6 prior to 17.2.9
• GitLab Enterprise Edition (EE) versions 17.3 prior to 17.3.5
• GitLab Community Edition (CE) and Enterprise Edition (EE) versions 17.4 prior to 17.4.2

Discovery Timeline

• 2025-02-05 - CVE-2024-9631 published to NVD
• 2025-08-06 - Last updated in NVD database

Technical Details for CVE-2024-9631

Vulnerability Analysis

This vulnerability is classified under CWE-407 (Inefficient Algorithmic Complexity) and CWE-770 (Allocation of Resources Without Limits or Throttling). The core issue lies in how GitLab processes and renders merge request diffs that contain conflicts. When a merge request with numerous or complex conflicts is viewed, the diff processing algorithm consumes excessive computational resources without proper throttling or optimization.

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can craft or trigger merge requests with specific conflict patterns that cause the diff rendering process to become extremely slow, consuming server resources and potentially causing service degradation or complete unavailability for other users.

Root Cause

The root cause stems from inefficient algorithmic handling of merge request conflict resolution visualization. The diff processing logic lacks adequate resource management controls, allowing computationally expensive operations to execute without proper limits. When processing merge requests with conflicts, the system performs excessive comparisons or allocations, leading to algorithmic complexity attacks.

Attack Vector

The attack can be executed remotely over the network. An attacker can submit or trigger merge requests designed to create conflict patterns that maximize processing time. When any user attempts to view the diff of such a merge request, the server enters a degraded state due to resource exhaustion. Since no authentication is required to trigger this condition in certain configurations, the attack surface is significant for publicly accessible GitLab instances.

The vulnerability mechanism involves creating or exploiting merge requests where the diff contains extensive conflicts. When the GitLab server attempts to process and display these conflicting diffs, the algorithm's inefficiency results in disproportionate resource consumption. Technical details regarding the specific exploitation patterns can be found in the GitLab Issue Report and HackerOne Report #2650086.

Detection Methods for CVE-2024-9631

Indicators of Compromise

• Unusual CPU or memory spikes on GitLab application servers when processing merge request views
• Slow or unresponsive merge request diff pages, particularly those with conflict markers
• Increased page load times or timeouts specifically affecting merge request functionality
• Log entries indicating timeouts or resource exhaustion during diff rendering operations

Detection Strategies

• Monitor GitLab application logs for repeated timeout errors associated with merge request diff processing
• Implement performance monitoring to detect abnormal resource consumption patterns during merge request operations
• Configure alerting for sustained high CPU or memory usage on GitLab web workers
• Review access logs for patterns of repeated requests to merge request diff endpoints

Monitoring Recommendations

• Deploy application performance monitoring (APM) solutions to track GitLab merge request processing times
• Set up resource utilization alerts with thresholds appropriate for your infrastructure baseline
• Monitor GitLab Sidekiq queues for backlogs that may indicate processing delays
• Implement rate limiting on merge request diff viewing endpoints where feasible

How to Mitigate CVE-2024-9631

Immediate Actions Required

• Upgrade GitLab CE/EE to version 17.2.9 or later for the 17.2.x branch
• Upgrade GitLab CE/EE to version 17.3.5 or later for the 17.3.x branch
• Upgrade GitLab CE/EE to version 17.4.2 or later for the 17.4.x branch
• Review and restrict access to merge request functionality for untrusted users if immediate patching is not possible

Patch Information

GitLab has released security patches addressing this vulnerability in versions 17.2.9, 17.3.5, and 17.4.2. Organizations should upgrade to these versions or later to remediate the vulnerability. The patches introduce optimizations and resource limits for merge request diff processing to prevent denial of service conditions. For detailed patch information, refer to the GitLab Issue Report.

Workarounds

• Implement rate limiting at the web server or load balancer level for merge request diff endpoints
• Restrict merge request creation permissions to authenticated and trusted users
• Configure web server timeouts to terminate long-running diff processing requests
• Consider temporarily disabling conflict diff visualization if attacks are actively occurring

# Example nginx rate limiting configuration for GitLab merge request endpoints
# Add to your nginx configuration file

# Define rate limiting zone
limit_req_zone $binary_remote_addr zone=gitlab_mr_limit:10m rate=5r/s;

# Apply rate limiting to merge request diff endpoints
location ~ ^/.*/-/merge_requests/.*/diffs {
    limit_req zone=gitlab_mr_limit burst=10 nodelay;
    proxy_pass http://gitlab-workhorse;
}