CVE-2023-3364

CVE-2023-3364 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting GitLab CE/EE versions before 16.0.8, 16.1.3, and 16.2.2. This flaw allows an unauthenticated attacker to trigger a denial of service by sending specially crafted payloads to the preview_markdown endpoint, leveraging the AutolinkFilter. Rated with a CVSS score of 7.5 (High), this vulnerability is easily exploitable over the network with low attack complexity, requiring no user interaction or privileges, and can lead to a complete denial of service. While its EPSS score is low, indicating a low probability of exploitation, its FAUCET Risk Score is 64/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, with only one article from GitLab Security confirming the patch release.