CVE-2021-39880 json
apollo_upload_server has Denial of Service vulnerability
published 2021-10-05 5 y ago modified 2026-09-08 2 mo ago also BIT-gitlab-2021-39880 , EUVD-2022-5513 , GHSA-w6pv-c757-6rgr
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 81%
- public exploits
- 0
- none known
Summary
A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE all versions starting from 11.9 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.
Patch / fix
- rubygems apollo_upload_server 2.1.0
- bitnami gitlab 14.0.9, 14.1.4, 14.2.2
- gitlab gitlab 14.0.9, 14.1.4, 14.2.2
- ruby-apollo-upload-server Debian 14, Debian 13, Debian 12 2.1.0-1
debian advisories DEBIAN-CVE-2021-39880
Exploit prediction
2.07% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:N/A:P |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | apollo_upload_server | <2.1.0 |
2.1.0 |
| bitnami | gitlab | >=11.9.0, <14.0.9 >=14.1.0, <14.1.4 >=14.2.0, <14.2.2 |
14.0.9 14.1.4 14.2.2 |
Affected products
- GitLab GitLab
Classification
- Technology feeds
References
-
github.com
/jetruby/apollo_upload_server-ruby/pull/44
web
-
github.com
/jetruby/apollo_upload_server-ruby/commit/b0582c1a3e458eee3c994fb38278bd0221f20486
web
-
gitlab.com
/gitlab-org/cves/-/blob/master/2021/CVE-2021-39880.json
web, vendor-advisory, advisory
-
gitlab.com
/gitlab-org/gitlab/-/issues/330561
web, broken-link
-
hackerone.com
/reports/1181284
web, permissions-required, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-39880
advisory, web
-
github.com
/jetruby/apollo_upload_server-ruby
package
-
github.com
/jetruby/apollo_upload_server-ruby/releases/tag/2.1.0
web
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/apollo_upload_server/CVE-2021-39880.yml
web
-
gitlab.com
/gitlab-org/gitlab/-/issues/330561#note_642879964
web
-
vuldb.com
/?id.183842
web
Sources
- CVE List CVE-2021-39880
- GitHub Advisory GHSA-w6pv-c757-6rgr
- NVD CVE-2021-39880
- OSV BIT-gitlab-2021-39880
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Enhance with deb and rpm package type records.