CVE-2021-39927

Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.x, between...

3.5 LowFix available

Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.4, between 14.5.0 and 14.5.2, and between 14.6.0 and 14.6.1 would fail to protect against attacks sending requests to localhost on port 80 or 443 if GitLab was configured to run on a port other than 80 or 443

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.57%Down 0.1 points since Jan 19, 2022

What each source reports

CVE List Score used 3.5

Record: CVE-2021-39927
CVSS 3.1: 3.5 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Updated: 2026-11-02

EUVDEUVD-2021-26283 3.5

Record: EUVD-2021-26283
CVSS 3.1: 3.5 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-76g9-63cr-m776 4.3

Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.x, between...

Server side request forgery protections in GitLab CE/EE versions between 8.4 and 14.4.x, between 14.5.0 and 14.5.x, and between 14.6.0 and 14.6.x would fail to protect against attacks sending requests to localhost on port 80 or 443 if GitLab was configured to run on a port other than 80 or 443

Record: GHSA-76g9-63cr-m776
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 3.5

Record: CVE-2021-39927
CVSS 3.1: 3.5 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSV 4.3

Record: CVE-2021-39927
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-39927 4.3

Record: UBUNTU-CVE-2021-39927
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1: 3.5 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Updated: 2026-11-02

OSVBIT-gitlab-2021-39927 No score

Record: BIT-gitlab-2021-39927
Updated: 2026-11-02

Affected products

gitlab

Affected packages

Affected packages
Package	Affected	Fixed
`gitlab` Bitnami	8.4.0 up to 14.4.5, 14.5.0 up to 14.5.3, 14.6.0 up to 14.6.2	14.4.514.5.314.6.2
`gitlab` Ubuntu:16.04:LTS	All versions, plus listed versions 8.4.3+dfsg-98.4.3+dfsg-128.5.8+dfsg-5	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-39927 is a low vulnerability (CVSS 3.5) in Gitlab, published January 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. Fixed in gitlab 14.4.5.