CVE-2026-104633

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104633

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.1.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability occurs during repository migration in Gitea. When a user migrates a repository from another Gitea instance, Gitea uses the source server's page size setting to control how many items are fetched per request. If the source server reports max_response_items as 0, Gitea enters an infinite loop fetching data, consuming increasing amounts of server memory until it crashes. This leads to a denial of service.

Detection Guidance

This vulnerability can be detected by monitoring for unusually high memory usage during repository migrations. Check Gitea logs for long-running migration processes or processes consuming excessive memory. No specific commands are provided in the context.

Impact Analysis

Any user with permission to migrate repositories could exploit this by pointing the migration at a server they control. This would cause the Gitea server to run out of memory and crash, disrupting service for all users. It requires minimal privileges but can severely impact system availability.

Compliance Impact

This vulnerability could lead to denial of service by exhausting server memory, potentially disrupting services handling sensitive data. This may impact compliance with GDPR (availability requirements) and HIPAA (security and integrity of PHI) if critical systems are affected.

Mitigation Strategies

Update Gitea to the latest version that patches this issue. Restrict repository migration permissions to trusted users only. Monitor server memory usage for unusual spikes during migration operations.

Hi! I’m here to help you understand CVE-2026-104633. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70