Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Cookie bomb#221041	Valid	Denial of Service	–	2018-02-16	–	6
ReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a year#1531958	Valid	Denial of Service	–	2022-09-13	–	9
ReDoS in syntax highlighting due to Rouge#1283484	Valid	Denial of Service	–	2021-11-15	$600	13
DOS via move_issue#1543584	Valid	Denial of Service	–	2022-11-04	$2,300	19
ReDoS due to device-detector parsing user agents#1772063	Valid	Denial of Service	Medium	2024-10-08	–	23
DOS via issue preview#1543718	Valid	Denial of Service	–	2022-11-04	$7,640	25
No redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.im#702987	Valid	Denial of Service	–	2020-05-15	–	26
Uncontrolled Resource Consumption in any Markdown field using Mermaid#670572	Valid	Denial of Service	–	2019-12-20	–	31
Clientside resource Exhausting by exploiting gitlab math rendering#549040	Valid	Denial of Service	–	2019-10-01	–	50
All functions that allow users to specify color code are vulnerable to ReDoS#511381	Valid	Denial of Service	–	2019-08-21	$1,000	53
DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted server#2499070	Valid	Denial of Service	Medium	2024-10-09	$2,300	64
Cache poisoning Denial of Service affecting assets.gitlab-static.net#1160407	Valid	Denial of Service	–	2021-12-22	–	83
DoS attack via comment on Issue#557154	Valid	Denial of Service	–	2019-11-21	$1,000	84
DoS on the Issue page by exploiting Mermaid.Analysed#470067	Valid	Denial of Service	–	2019-05-13	$3,000	145

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (549 analysed so far), which can be wrong. Data as of 2026-11-14.