Unauthenticated ReDoS via CODEOWNERS Pattern Matching

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Gitea Limited

Description

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-58421

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated Regular Expression Denial of Service (ReDoS) attack that occurs via CODEOWNERS pattern matching.

It allows an attacker to cause a denial of service by exploiting the way pattern matching is performed in CODEOWNERS files.

Impact Analysis

The vulnerability can lead to a denial of service condition, potentially making the affected system or service unavailable.

Since it is unauthenticated, an attacker does not need to be logged in or have special permissions to exploit it.

Hi! I’m here to help you understand CVE-2026-58421. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70