All vulnerabilities
CVE-2026-60021GHSA-5952-x23q-p23f

Gitea GitLab migration denial of service

Gitea Gitea
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.55%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.27.3Fixed versionCVE List
Published14 Oct 2026Updated 18 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.

Text from CVE List

Affected versions 1

  • Giteaaffected: 1.16.0 before 1.27.3CVE List

References 5