Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| DoS on the Issue page by exploiting Mermaid.Analysed#470067 | Valid | Denial of Service | Medium | 2019-05-13 | $3,000 | 145 |
| DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted serverAnalysed#2499070 | Valid | Denial of Service | Medium | 2024-10-09 | $2,300 | 64 |
| Uncontrolled Resource Consumption in any Markdown field using MermaidAnalysed#670572 | Valid | Denial of Service | Medium | 2019-12-20 | – | 31 |
| ReDoS due to device-detector parsing user agentsAnalysed#1772063 | Valid | Denial of Service | Medium | 2024-10-08 | – | 23 |
| DOS via move_issueAnalysed#1543584 | Valid | Denial of Service | Medium | 2022-11-04 | $2,300 | 19 |
| ReDoS in syntax highlighting due to Rouge#1283484 | Valid | Denial of Service | Medium | 2021-11-15 | $600 | 13 |
| ReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a year#1531958 | Valid | Denial of Service | Medium | 2022-09-13 | – | 9 |
| Cookie bomb#221041 | Valid | Denial of Service | Medium | 2018-02-16 | – | 6 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.