CVE-2026-60018
CVE-2026-60018 · Gitea OneDev migration denial of service
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or never-ending response. This can consume memory and hold migration workers, impairing service availability.
CVSS 6.5 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Affected products and versions
gitea
- Versions
- ≥ 1.16.0, < 1.27.3: Affected (semver)
Update to 1.27.3
Original sources
- https://github.com/go-gitea/gitea/security/advisories/GHSA-46px-6cqx-c5fv
- https://blog.gitea.com/release-of-1.27.3/
- https://github.com/go-gitea/gitea/pull/39024
- https://github.com/go-gitea/gitea/pull/39033
- https://github.com/go-gitea/gitea/releases/tag/v1.27.3
- https://nvd.nist.gov/vuln/detail/CVE-2026-60018