Vulnerability · Published Oct 14, 2026 · Assigned by Gitea

CVE-2026-60021Gitea GitLab migration denial of service

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 53.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	1.16.0 – before 1.27.3

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory GHSA-5952-x23q-p23f vendor-advisory
Gitea 1.27.3 release announcement release-notes
Fix: go-gitea/gitea pull request #39023 patch
Fix: go-gitea/gitea pull request #39035 patch
go-gitea/gitea v1.27.3 release release-notes