CVE-2026-60018
CVE-2026-60018 · Gitea OneDev migration denial of service
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or never-ending response. This can consume memory and hold migration workers, impairing service availability.
CVSS 6.5 · Media · EPSS 0,5% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
gitea
- Versiones
- ≥ 1.16.0, < 1.27.3: Afectada (semver)
Actualiza a 1.27.3
Fuentes originales
- https://github.com/go-gitea/gitea/security/advisories/GHSA-46px-6cqx-c5fv
- https://blog.gitea.com/release-of-1.27.3/
- https://github.com/go-gitea/gitea/pull/39024
- https://github.com/go-gitea/gitea/pull/39033
- https://github.com/go-gitea/gitea/releases/tag/v1.27.3
- https://nvd.nist.gov/vuln/detail/CVE-2026-60018