Log in Start free

Vulnerability · Published Oct 6, 2026 · Assigned by Gitea

CVE-2026-104633Gitea migration memory exhaustion from zero page size

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 65.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service.

Affected products (as reported)

VendorProductVersions
Gitea Gitea 0 – through 28.0.0

Weakness: CWE-400, CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References