Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
DoS on the Issue page by exploiting Mermaid.Analysed#470067	Valid	Denial of Service	Medium	2019-05-13	$3,000	145
DoS attack via comment on IssueAnalysed#557154	Valid	Denial of Service	Low	2019-11-21	$1,000	84
Cache poisoning Denial of Service affecting assets.gitlab-static.netAnalysed#1160407	Valid	Denial of Service	High	2021-12-22	–	83
DOS: taking down a 1k users Gitlab EE instance or multiple Sidekiq instances by importing a malicious repo from a Github EE self-hosted serverAnalysed#2499070	Valid	Denial of Service	Medium	2024-10-09	$2,300	64
All functions that allow users to specify color code are vulnerable to ReDoS#511381	Valid	Denial of Service	Low	2019-08-21	$1,000	53
Clientside resource Exhausting by exploiting gitlab math rendering#549040	Valid	Denial of Service	Low	2019-10-01	–	50
Uncontrolled Resource Consumption in any Markdown field using Mermaid#670572	Valid	Denial of Service	Medium	2019-12-20	–	31
No redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.im#702987	Valid	Denial of Service	Low	2020-05-15	–	26
DOS via issue preview#1543718	Valid	Denial of Service	High	2022-11-04	$7,640	25
ReDoS due to device-detector parsing user agents#1772063	Valid	Denial of Service	Medium	2024-10-08	–	23
DOS via move_issue#1543584	Valid	Denial of Service	Medium	2022-11-04	$2,300	19
ReDoS in syntax highlighting due to Rouge#1283484	Valid	Denial of Service	Medium	2021-11-15	$600	13
ReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a year#1531958	Valid	Denial of Service	Medium	2022-09-13	–	9
Cookie bomb#221041	Valid	Denial of Service	–	2018-02-16	–	6

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,443 analysed so far), which can be wrong. Data as of 2026-11-14.