# ReDoS in net/http affects webhooks: Sidekiq job stuck at 100% CPU for a year

Ruby net/http header regex has quadratic ReDoS; a malicious webhook receiver returns a long space-padded header, pinning GitLab's web_hook Sidekiq job at 100% CPU for over a year.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: afewgoats
- Disclosed: 2022-09-13
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1531958
- Library page: https://bugbountylibrary.com/r/h1%3A1531958
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:ruby technique:source-review vuln:dos vuln:misconfiguration

**Target:** GitLab webhook receiver response processing via Ruby net/http
**Root cause:** net/http/response.rb uses `sock.readuntil("\n", true).sub(/\s+\z/, '')`; the unanchored `\s+\z` regex backtracks quadratically over long runs of spaces not ending in whitespace.
**Steps:**
1. Run malicious node server: `node ./net-http-response.js` on port 3000
2. Create project webhook for issue events pointing to `http://maliciousserver:3000/xyz`
3. Enable 'Allow requests to the local network from web hooks' if on local network
4. Create/close/reopen an issue to trigger the webhook
5. Server responds `HTTP/1.1 200 OK` then a header line with 9,500,000 consecutive spaces mid-line
6. Observe web_hook Sidekiq job stuck at 100% CPU in /admin/background_jobs and top
**How found:** Researcher read net/http/response.rb header parsing, noticed the unanchored `\s+\z` sub regex, hypothesized quadratic backtracking on long space runs, and benchmarked timings extrapolating to years for 10M spaces.
**Exploitation:** Attacker controls a webhook receiver endpoint; on receiving GitLab's webhook request it replies with a header line containing millions of consecutive spaces not ending in whitespace, forcing the net/http header regex into quadratic backtracking inside the Sidekiq worker. Multiple slow connections can also exhaust the connection pool, bypassing the prior timeout fix since the timeout is only checked between header lines.
**Escalation:** Chaining multiple webhook connections with slow data to exhaust connection pool and memory in addition to CPU; affects any Gitlab::HTTP.post caller (system hooks, Mattermost integration).
**Insight:** Unanchored trailing-whitespace regexes like `/\s+\z/` are quadratic on long non-matching space runs; audit HTTP client header parsers and any `sub`/`gsub` with `\s+` at end-of-string for ReDoS, especially where timeouts are only checked between lines.