GitLab · disclosed reports
Denial of Service
14 disclosed reports · $17,840 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open GitLab on HackerOne- reports
- 14
- paid a bounty
- 7
Every one of the 14 is a mark on the map. Named now: 1 to 14, most upvoted first.
- DoS on the Issue page by exploiting Mermaid.
- DoS attack via comment on Issue
- Cache poisoning Denial of Service affecting assets.gitlab-static.net
- DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted server
- All functions that allow users to specify color code are vulnerable to ReDoS
- Clientside resource Exhausting by exploiting gitlab math rendering
- Uncontrolled Resource Consumption in any Markdown field using Mermaid
- No redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.im
- DOS via issue preview
- ReDoS due to device-detector parsing user agents
- DOS via move_issue
- ReDoS in syntax highlighting due to Rouge
- ReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a year
- Cookie bomb
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.