CVE-2024-2454

What it actually does

Authenticated requests to the pins endpoint can be crafted to exhaust server resources, resulting in denial of service with high availability impact.

Why it matters to the business

Attackers can trigger outages that halt development, code review, and CI/CD pipelines until the service is restored, increasing operational costs and delaying releases.

How an attack unfolds

An authenticated user crafts a malicious request to the pins endpoint that triggers excessive resource consumption; repeated requests can render the GitLab instance unresponsive.

How to fix it

Upgrade GitLab CE/EE to 16.9.7, 16.10.5, 16.11.2 or later; the fix is included in commit 6878f253b7b50c8e6217ebfd03717b5e5ea960a4.

How to confirm the fix worked

Confirm the installed version is at or above the fixed releases; attempt to reproduce the crafted request in a test environment and verify the endpoint no longer causes resource exhaustion.

Typical attack path

1. Obtain a valid GitLab user session with low privileges
2. Identify the pins API endpoint
3. Submit a specially crafted HTTP request designed to trigger resource exhaustion
4. Observe service degradation or complete unavailability

How to detect it

Review web server and application logs for repeated or anomalous requests to the pins endpoint; correlate with spikes in CPU/memory utilization on GitLab hosts.

• POST /api/v4/projects/*/pins
• unusual query parameters on pins endpoint
• sudden high memory or CPU usage on gitlab-rails processes

What your security team should do

• Apply the listed version upgrades immediately due to the moderate EPSS score and public availability of affected versions
• Restrict access to the pins endpoint via network controls or WAF rules until patches are deployed
• Monitor CPU and memory usage on GitLab application servers for sudden spikes