CVE-2024-2800 is a Medium severity (CVSS 6.5) regular expression denial of service flaw in GitLab CE and EE, in the code that matches branch names with wildcards. It affects versions from 11.3 before 17.0.6, 17.1 before 17.1.4 and 17.2 before 17.2.2. Upgrade to those versions or later.
What's affected
- Product: GitLab Community Edition and Enterprise Edition.
- Affected: 11.3 up to but not including 17.0.6; 17.1 before 17.1.4; 17.2 before 17.2.2.
- Fixed: 17.0.6, 17.1.4 and 17.2.2 (the first versions outside each affected range per the record).
- Weakness: CWE-1333.
- Access needed: a low privilege account over the network (CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
The GitLab issue tracker page in the references returned a not found error when we tried it, so the version ranges here come from the NVD record.
How to check if you're exposed
For a self managed instance, read the version from the Help page in the web interface, or from the command line on the server:
sudo gitlab-rake gitlab:env:info
Compare the result with the ranges above. GitLab.com is run by GitLab, so only self managed installs need action.
What to do now
- Find the version of each self managed GitLab instance.
- Upgrade to 17.0.6, 17.1.4, 17.2.2 or later within your release line, following GitLab's upgrade path guidance.
- Check which accounts can create or edit branch rules, since the flaw needs a low privilege account.
- Watch CPU load on the web and Sidekiq nodes after upgrading to confirm normal behaviour.
- Record the upgrade in your change log for audit purposes.
Why it matters
Regular expression denial of service (ReDoS) occurs when a pattern can take exponentially longer to evaluate on certain inputs. A single crafted string can pin a CPU core for a long time.
The classic cause is nested or overlapping quantifiers in a pattern. Fixes either rewrite the pattern, cap input length, or use a regex engine with linear time guarantees.
In GitLab, wildcard branch patterns are used in protected branch and similar rules. If the matching code can be made to backtrack heavily, a single request can occupy a worker for a long time, and several can degrade the service for everyone. Impact here is availability only: the vector shows no confidentiality or integrity effect.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Try it yourself
Upgrade fixes like this one are easiest when you can see which release clears the finding. The fix available demo walks through that view.
Click through it at your own pace, or open it full screen.
Quick check
Does this affect GitLab.com?
The record concerns GitLab CE and EE versions. GitLab runs GitLab.com itself, so the action item is for self managed instances.
Does it expose data?
No. The CVSS vector scores confidentiality and integrity as none and availability as high.
Sources
Record references (the GitLab issue page was not retrievable):
Last reviewed: 19 October 2026.
