# Uncontrolled Resource Consumption in any Markdown field using Mermaid

GitLab's 5000-char Mermaid input limit (fix for CVE-2019-9220) is bypassed by splitting payload across 100 code blocks, freezing victims' browsers on any Markdown page.

- Payout: hidden
- Severity: medium
- Program: GitLab
- Found by: ryhmnlfj
- Disclosed: 2019-12-20
- CVE: CVE-2019-15584, CVE-2019-9220
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/670572
- Library page: https://bugbountylibrary.com/r/h1%3A670572
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium tech:rest technique:incomplete-fix vuln:dos

**Target:** Markdown/Mermaid rendering in GitLab web UI
**Root cause:** The DoS mitigation for CVE-2019-9220 caps each Mermaid code block at 5000 characters but does not limit the number of Mermaid blocks per Markdown field, so total render work is unbounded.
**Steps:**
1. Sign in to GitLab.
2. Open any page accepting Markdown with Mermaid (e.g. an Issue comment).
3. Paste a payload of 100 Mermaid code blocks, each ~5000 characters.
4. Save/comment; the page renders all blocks and the browser tab freezes, consuming increasing resources.
**How found:** Researcher recognized the prior CVE-2019-9220 fix enforced a per-block 5000-char limit and hypothesized the limit could be evaded by multiplying blocks rather than enlarging one.
**Exploitation:** Attacker posts a comment/issue containing many max-length Mermaid blocks; any user viewing the page triggers rendering of all graphs, freezing or crashing their browser tab and blocking interaction with the page.
**Insight:** When a DoS fix caps size per item, test whether the count of items is also bounded; per-instance limits are trivially bypassed by fan-out across many instances.