CVE-2023-0921: GitLab CE/EE missing length validation in Issue descriptions enables CPU exhaustion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityCVSS rates it medium (4.3) with only low availability impact, but the very high EPSS score and trivial authenticated trigger warrant prompt patching.

What it is

GitLab CE/EE lacks length validation on Issue descriptions submitted via GraphQL, allowing an authenticated user to create an oversized description. Repeatedly requesting that issue saturates CPU usage, degrading availability for other users.

Impact

An authenticated attacker can cause sustained CPU saturation on the GitLab instance, leading to slow responses or denial of service for legitimate users.

Attack surface

Reachable over the network through the GraphQL API by any authenticated user; no user interaction is required beyond the attacker's own requests.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged, but EPSS is very high (0.84438, 99.7th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade GitLab CE/EE to 15.10.8, 15.11.7, or 16.0.2 or later as applicable.
• Enforce request and payload size limits at the reverse proxy or API gateway in front of GitLab.
• Rate-limit GraphQL requests per authenticated user and monitor for abnormal issue description sizes.
• Restrict or audit API tokens and accounts with issue creation permissions.

Detection

• Monitor GraphQL mutation logs for unusually large Issue description payloads.
• Alert on repeated requests to the same large issue within short time windows.
• Track sustained CPU spikes on GitLab application nodes correlated with issue read activity.
• Review audit logs for a single user creating or repeatedly fetching oversized issues.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.