CVE-2024-9367

What it actually does

Uncontrolled CPU consumption triggered during template parsing for changelog generation.

Why it matters to the business

Service becomes unavailable or severely degraded, disrupting development and release processes until the affected instance is restarted or resources are exhausted.

How an attack unfolds

An attacker supplies a specially crafted template used for changelog generation; the parser enters an inefficient code path that consumes CPU without bound, leading to denial of service.

How to fix it

Upgrade GitLab CE/EE to 17.4.6, 17.5.4, or 17.6.2 or later depending on the current branch.

How to confirm the fix worked

Confirm the running version is at or above the fixed releases; monitor CPU usage during template rendering operations after upgrade.

Typical attack path

1. Identify an instance running an affected GitLab version
2. Obtain permission to trigger changelog template rendering (via API or UI)
3. Submit a malicious template designed to trigger excessive CPU usage
4. Observe resource exhaustion and service degradation or outage

How to detect it

Review application logs for repeated or long-running changelog template parsing operations; correlate with spikes in CPU utilization on GitLab application servers.

What your security team should do

• Apply the listed version upgrades immediately
• Restrict changelog generation permissions to trusted users until patched
• Monitor for unusual CPU spikes correlated with changelog API calls