CVE-2021-39880 — Vulnerability in apollo_upload_server — CVE Details
MEDIUM
apollo_upload_server has Denial of Service vulnerability
Published May 24, 2022Updated December 3, 2024Source: osv
Summary
A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE version 11.11 and above allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.
Advisory Timeline
- First published May 24, 2022 (1602 days ago).
- Last revised December 3, 2024 — 923 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
Bundler
Update apollo_upload_server to 2.1.0 or latergem install apollo_upload_server -v 2.1.0
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (1)
Affects 1 ecosystem: rubygems (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| apollo_upload_server | rubygems | 0.1.0, 1.0.0, 2.0.0, 2.0.0.alpha.1 (+13 more) | 2.1.0 |
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-39880ADVISORY
- https://github.com/jetruby/apollo_upload_server-ruby/pull/44WEB
- https://github.com/jetruby/apollo_upload_server-ruby/commit/b0582c1a3e458eee3c994fb38278bd0221f20486WEB
- https://hackerone.com/reports/1181284WEB
- https://github.com/jetruby/apollo_upload_server-rubyPACKAGE
- https://github.com/jetruby/apollo_upload_server-ruby/releases/tag/2.1.0WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/apollo_upload_server/CVE-2021-39880.ymlWEB
- https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39880.jsonWEB
- https://gitlab.com/gitlab-org/gitlab/-/issues/330561WEB
- https://gitlab.com/gitlab-org/gitlab/-/issues/330561#note_642879964WEB
- https://vuldb.com/?id.183842WEB
Frequently Asked Questions
- What is CVE-2021-39880?
- apollo_upload_server has Denial of Service vulnerability This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
- How do I check if my project is affected by CVE-2021-39880?
- CVE-2021-39880 affects apollo_upload_server. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2021-39880 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
6.5
Exploitation requires specific conditions or has limited impact. Remediate within weeks.
Also Known As
GHSA-w6pv-c757-6rgr
BIT-gitlab-2021-39880
Related CVEs
- CVE-2026-107715MEDIUM
Mechanize sends credential headers to another host after an HTTP redirect
- CVE-2026-107399MEDIUM
Mechanize sends credential headers to another origin after a meta refresh
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies