CVE-2026-104633

Gitea migration memory exhaustion from zero page size

State: Published
Severity: 6.5 Medium
Published: Oct 6, 2026
Updated: Oct 7, 2026
Reserved: Oct 4, 2026

Description

When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-400 Uncontrolled Resource Consumption
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

Affected Products

Product	Versions
GiteaGitea	28.0.0 and earlierAffected

References

GitHub Security Advisory GHSA-jj5r-9rpc-8h6hvendor-advisory
Fix: go-gitea/gitea pull request #39501patch
Fix backport to release/v28: go-gitea/gitea pull request #39507patch
Gitea 28.1.0 release announcementrelease-notes
go-gitea/gitea v28.1.0 releaserelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.