Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:alpm/archlinux/gitlab@14.5.2-1
purl pkg:alpm/archlinux/gitlab@14.5.2-1
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (16)
Vulnerability Summary Aliases
VCID-1f4t-7du8-q3ex A vulnerable regular expression pattern in GitLab CE/EE since version 8.15 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to cause uncontrolled resource consumption leading to Denial of Service via specially crafted deploy Slash commands CVE-2021-39938
VCID-5t99-3qbr-sfdj An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression used for handling user input (notes, comments, etc) was susceptible to catastrophic backtracking that could cause a DOS attack. CVE-2021-39933
VCID-6ns1-mx95-5ffe An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab Maven Package registry is vulnerable to a regular expression denial of service when a specifically crafted string is sent. CVE-2021-39940
VCID-71j9-ra1c-6uhm Improper access control allows any project member to retrieve the service desk email address in GitLab CE/EE versions starting 12.10 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. CVE-2021-39934
VCID-989x-8yn6-eqc8 A collision in access memoization logic in all versions of GitLab CE/EE before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, leads to potential elevated privileges in groups and projects under rare circumstances CVE-2021-39937
VCID-99uy-2jrp-u7cx Improper access control in GitLab CE/EE affecting all versions starting from 10.7 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker in possession of a deploy token to access a project's disabled wiki. CVE-2021-39936
VCID-9mm8-knzf-a3gb Improper access control in the GitLab CE/EE API affecting all versions starting from 9.4 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an author of a Merge Request to approve the Merge Request even after having their project access revoked CVE-2021-39945
VCID-9wuq-32s1-nydy Improper access control in the GraphQL API in GitLab CE/EE affecting all versions starting from 13.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, allows an attacker to see the names of project access tokens on arbitrary projects CVE-2021-39915
VCID-buuk-gsy3-w7bp In all versions of GitLab CE/EE starting version 14.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2, the reset password token and new user email token are accidentally logged which may lead to information disclosure. CVE-2021-39919
VCID-gvwq-zqmf-ruak An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature. CVE-2021-39910
VCID-h8td-pdxx-y7en An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A regular expression related to quick actions features was susceptible to catastrophic backtracking that could cause a DOS attack. CVE-2021-39917
VCID-m6c7-dfbf-r7gr An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.11 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under specific condition an unauthorised project member was allowed to delete a protected branches due to a business logic error. CVE-2021-39931
VCID-t8nq-hx26-kfc7 An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API CVE-2021-39935
VCID-uzq6-eukx-8yhv An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. A permissions validation flaw allowed group members with a developer role to elevate their privilege to a maintainer on projects they import CVE-2021-39944
VCID-vfvr-mjgk-4qce An information disclosure vulnerability in GitLab CE/EE versions 12.0 to 14.3.6, 14.4 to 14.4.4, and 14.5 to 14.5.2 allowed non-project members to see the default branch name for projects that restrict access to the repository to project members CVE-2021-39941
VCID-w1jg-8rdt-3ufv An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.0 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Using large payloads, the diff feature could be used to trigger high load time for users reviewing code changes. CVE-2021-39932

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T18:25:13.759352+00:00 Arch Linux Importer Fixing VCID-gvwq-zqmf-ruak https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.736157+00:00 Arch Linux Importer Fixing VCID-9wuq-32s1-nydy https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.714510+00:00 Arch Linux Importer Fixing VCID-h8td-pdxx-y7en https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.692746+00:00 Arch Linux Importer Fixing VCID-buuk-gsy3-w7bp https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.666993+00:00 Arch Linux Importer Fixing VCID-m6c7-dfbf-r7gr https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.644277+00:00 Arch Linux Importer Fixing VCID-w1jg-8rdt-3ufv https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.619434+00:00 Arch Linux Importer Fixing VCID-5t99-3qbr-sfdj https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.595929+00:00 Arch Linux Importer Fixing VCID-71j9-ra1c-6uhm https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.571485+00:00 Arch Linux Importer Fixing VCID-t8nq-hx26-kfc7 https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.547125+00:00 Arch Linux Importer Fixing VCID-99uy-2jrp-u7cx https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.520237+00:00 Arch Linux Importer Fixing VCID-989x-8yn6-eqc8 https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.497600+00:00 Arch Linux Importer Fixing VCID-1f4t-7du8-q3ex https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.473522+00:00 Arch Linux Importer Fixing VCID-6ns1-mx95-5ffe https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.449928+00:00 Arch Linux Importer Fixing VCID-vfvr-mjgk-4qce https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.427748+00:00 Arch Linux Importer Fixing VCID-uzq6-eukx-8yhv https://security.archlinux.org/AVG-2603 38.0.0
2026-04-01T18:25:13.404405+00:00 Arch Linux Importer Fixing VCID-9mm8-knzf-a3gb https://security.archlinux.org/AVG-2603 38.0.0