CVE-2026-60021

Deferred Deferred - Pending Action

Gitea GitLab Migration Worker Pool Exhaustion

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-60021

EUVD

EUVD-2026-101081

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	1.16.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-60021 is an authenticated Denial of Service (DoS) vulnerability in Gitea's GitLab migration feature. It occurs because the system probes the remote GitLab server's version endpoint without a timeout and does not cancel the probe when the migration task is cancelled. This allows an attacker-controlled server to keep the connection open indefinitely, blocking the migration worker pool and preventing other migrations from proceeding.

Detection Guidance

Check Gitea version with 'gitea --version' or via the web interface. If running versions 1.16.0 to 1.27.2, the system is vulnerable. Monitor migration worker pool exhaustion or blocked tasks during GitLab migrations.

Impact Analysis

If exploited, this vulnerability can exhaust the migration worker pool, causing legitimate migration tasks to hang or fail. This disrupts repository migrations and may lead to service unavailability for users attempting to migrate repositories. The impact is primarily on availability and system performance.

Compliance Impact

This vulnerability primarily impacts availability by allowing an authenticated user to exhaust migration worker pools, causing denial of service. It does not directly expose or compromise personal data, so it likely has minimal direct impact on GDPR or HIPAA compliance. However, prolonged unavailability of migration services could indirectly affect compliance if critical data processing or access is disrupted.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. Restrict repository-migration permissions to trusted users only until patched.

Hi! I’m here to help you understand CVE-2026-60021. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70