Memory Exhaustion in Gitea Migration Downloader

Executive Summary

This is an authenticated Denial of Service (DoS) vulnerability in Gitea's OneDev migration feature. The migration downloader reads the entire remote server response without size limits or timeout settings. An attacker with authenticated access can start a repository migration to a malicious server that returns an oversized or endless response, causing Gitea to consume excessive memory and block migration workers.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusually high memory usage during migration processes or network requests to the /~api/version/server endpoint. Check Gitea logs for migration worker timeouts or stalled processes. Use system monitoring tools like top, htop, or ps to track memory consumption by Gitea processes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to service disruption by consuming excessive memory and holding migration workers indefinitely. In constrained environments, it may cause memory pressure or out-of-memory conditions, impairing Gitea's availability and performance.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts service availability by enabling denial-of-service conditions through memory exhaustion. While it does not directly violate GDPR or HIPAA, it could indirectly affect compliance by disrupting access to personal or health data processing systems during an attack. GDPR requires ensuring availability of processing systems, and HIPAA mandates safeguards against disruptions that could compromise protected health information. Exploits could lead to prolonged downtime, potentially violating these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later to apply the patch. Restrict repository migration permissions to trusted users only. Monitor migration processes for abnormal behavior and set resource limits for Gitea processes.

Useful 0 Not Useful 0