CyberRota Analysis
AI-GeneratedGitea instances are vulnerable during repository migrations, where an improperly configured source server can cause infinite loops in paginated downloads, leading to excessive memory consumption and potential denial of service. This issue can be exploited by any user with migration permissions, allowing them to target a controlled server and exhaust its resources. Organizations using Gitea should prioritize addressing this vulnerability to prevent possible service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service.
Related CVEs
Other vulnerabilities affecting the same vendor(s)