CVE-2024-6826

What it actually does

Maliciously crafted XML manifest files trigger excessive resource consumption during import processing, resulting in denial of service.

Why it matters to the business

GitLab instances can experience service outages or degraded performance when users import projects, leading to lost productivity and potential data access issues until the instance is restarted or recovered.

How an attack unfolds

An attacker creates a specially crafted XML manifest file designed to exhaust CPU, memory, or other resources during parsing. They then use the project import feature in an affected GitLab version to upload the file, causing the instance to become unresponsive.

How to fix it

Upgrade GitLab to version 17.3.6 or later, 17.4.3 or later, or 17.5.1 or later. The fix is included in commit cf36eeb39e6b055c08297149dc98ad1cc90248be.

How to confirm the fix worked

Verify the running GitLab version is at or above the fixed releases. Test the import functionality with known-safe manifest files and monitor resource usage during imports to confirm the issue is resolved.

Typical attack path

1. Craft a malicious XML manifest file that triggers resource exhaustion on import
2. Authenticate to a GitLab instance with permission to import projects
3. Initiate a project import using the crafted XML file
4. Observe service degradation or crash on the GitLab instance

How to detect it

Review application logs for import job failures or timeouts, monitor system metrics for sudden resource spikes tied to XML processing, and inspect audit logs for project import events from untrusted sources.

What your security team should do

• Immediately upgrade all GitLab instances to a fixed version
• Restrict project import permissions to trusted users until patched
• Monitor system resources and import-related processes for unusual spikes