apollo_upload_server has Denial of Service vulnerability

中危 6.5CVE-2021-39880 · BIT-gitlab-2021-39880 · GHSA-w6pv-c757-6rgr · Published 05/10/2021 · updated 17/06/2026

要点

CVE-2021-39880 是影响 apollo_upload_server, gitlab (gitlab) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：2.1%，高于 81.5% 的漏洞。
修复：升级到 2.1.0, 14.0.9, 14.1.4, 14.2.2 或更高版本。

Package	Affected versions	Patched versions
apollo_upload_server RubyGems	`< 2.1.0`	`2.1.0`
gitlab gitlab	`≥ 11.9.0, < 14.0.9≥ 14.1.0, < 14.1.4≥ 14.2.0, < 14.2.2> 11.9.0, < 14.0.9> 14.1.0, < 14.1.4`	`14.0.914.1.414.2.2`

Description

A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE version 11.11 and above allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.

NVD description

A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.

References

nvd.nist.gov/vuln/detail/CVE-2021-39880 · ADVISORY
jetruby/apollo_upload_server-ruby#44 · WEB
jetruby/apollo_upload_server-ruby commit b0582c1 · WEB
hackerone.com/reports/1181284 · WEB
jetruby/apollo_upload_server-ruby · PACKAGE
jetruby/apollo_upload_server-ruby release 2.1.0 · WEB
rubysec/ruby-advisory-db · WEB
gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39880.json · WEB
gitlab.com/gitlab-org/gitlab/-/issues/330561 · WEB
gitlab.com/gitlab-org/gitlab/-/issues/330561 · WEB
vuldb.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apollo_upload_server

RubyGems

< 2.1.0

2.1.0

gitlab

≥ 11.9.0, < 14.0.9≥ 14.1.0, < 14.1.4≥ 14.2.0, < 14.2.2> 11.9.0, < 14.0.9> 14.1.0, < 14.1.4

14.0.914.1.414.2.2

Description

NVD description