Vulnerability · Published Oct 14, 2026 · Assigned by Gitea

CVE-2026-60018Gitea OneDev migration denial of service

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 53.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or never-ending response. This can consume memory and hold migration workers, impairing service availability.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	1.16.0 – before 1.27.3

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory GHSA-46px-6cqx-c5fv vendor-advisory
Gitea 1.27.3 release announcement release-notes
Fix: go-gitea/gitea pull request #39024 patch
Fix: go-gitea/gitea pull request #39033 patch
go-gitea/gitea v1.27.3 release release-notes