CVE-2024-2829 is a High severity (CVSS 7.5) denial of service flaw in GitLab CE and EE, where a crafted wildcard filter in FileFinder can exhaust resources. It affects 12.5 before 16.9.6, 16.10 before 16.10.4 and 16.11 before 16.11.1. Upgrade to a fixed release.
What's affected
- Product: GitLab Community Edition and Enterprise Edition.
- Affected: 12.5 before 16.9.6; 16.10 before 16.10.4; 16.11 before 16.11.1.
- Fixed: 16.9.6, 16.10.4, 16.11.1 or later.
- Weakness: CWE-1333.
- Access needed: no account over the network (CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
The record published 25 April 2024. The GitLab issue page in the references was not retrievable for us, so ranges come from the NVD record.
How to check if you're exposed
On a self managed server, read the version from the Help page or run:
sudo gitlab-rake gitlab:env:info
Then compare with the ranges. Note that 16.9 earlier than 16.9.6 is affected, as is anything from 12.5 upward on older lines.
What to do now
- Identify every self managed GitLab instance and its version.
- Plan an upgrade to 16.9.6, 16.10.4, 16.11.1 or later, following the official upgrade path.
- Until upgraded, watch for unusual CPU usage on application nodes.
- Confirm the new version after the upgrade from the Help page.
Why it matters
Regular expression denial of service (ReDoS) occurs when a pattern can take exponentially longer to evaluate on certain inputs. A single crafted string can pin a CPU core for a long time.
The classic cause is nested or overlapping quantifiers in a pattern. Fixes either rewrite the pattern, cap input length, or use a regex engine with linear time guarantees.
FileFinder is part of how GitLab searches file names inside repositories. A wildcard filter that triggers heavy backtracking can tie up a worker, and repeated requests can slow the instance for all users. The impact is limited to availability.
KEV status: the record has the CISA Known Exploited Vulnerabilities flag set to false, and none of the sources we could read says this is exploited in the wild. That can change, so watch for updates.
Try it yourself
Version drift is how instances end up behind on fixes like this. The monitoring demo shows how ongoing checks surface that.
Click through it at your own pace, or open it full screen.
Quick check
What score does the record give?
7.5, High, with availability as the only impact.
Which versions are safe?
16.9.6, 16.10.4, 16.11.1 and later releases, per the ranges in the record.
Sources
Record references (the GitLab issue page was not retrievable):
Last reviewed: 19 October 2026.
