{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-104633", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-10-04T22:02:04.892Z", "datePublished": "2026-10-06T21:35:26.516Z", "dateUpdated": "2026-10-07T15:53:48.550Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-10-06T21:35:26.516Z"}, "title": "Gitea migration memory exhaustion from zero page size", "descriptions": [{"lang": "en", "value": "When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service."}], "affected": [{"vendor": "Gitea", "product": "Gitea", "packageName": "gitea.dev", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "28.0.0", "versionType": "semver"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-jj5r-9rpc-8h6h", "name": "GitHub Security Advisory GHSA-jj5r-9rpc-8h6h", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39501", "name": "Fix: go-gitea/gitea pull request #39501", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/39507", "name": "Fix backport to release/v28: go-gitea/gitea pull request #39507", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.1.0/", "name": "Gitea 28.1.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.1.0", "name": "go-gitea/gitea v28.1.0 release", "tags": ["release-notes"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}, {"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "credits": [{"lang": "en", "value": "https://github.com/kewmine", "type": "reporter"}, {"lang": "en", "value": "https://github.com/silverwind", "type": "remediation developer"}, {"lang": "en", "value": "https://github.com/bircni", "type": "remediation developer"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-07T15:51:08.820853Z", "id": "CVE-2026-104633", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T15:53:48.550Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-104633", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-07T15:51:08.820853Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-07T15:51:00.622Z"}}], "cna": {"title": "Gitea migration memory exhaustion from zero page size", "credits": [{"lang": "en", "type": "reporter", "value": "https://github.com/kewmine"}, {"lang": "en", "type": "remediation developer", "value": "https://github.com/silverwind"}, {"lang": "en", "type": "remediation developer", "value": "https://github.com/bircni"}], "affected": [{"vendor": "Gitea", "product": "Gitea", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "28.0.0"}], "packageName": "gitea.dev", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-jj5r-9rpc-8h6h", "name": "GitHub Security Advisory GHSA-jj5r-9rpc-8h6h", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/39501", "name": "Fix: go-gitea/gitea pull request #39501", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/39507", "name": "Fix backport to release/v28: go-gitea/gitea pull request #39507", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.1.0/", "name": "Gitea 28.1.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.1.0", "name": "go-gitea/gitea v28.1.0 release", "tags": ["release-notes"]}], "descriptions": [{"lang": "en", "value": "When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}, {"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-10-06T21:35:26.516Z"}}}, "cveMetadata": {"cveId": "CVE-2026-104633", "state": "PUBLISHED", "dateUpdated": "2026-10-07T15:53:48.550Z", "dateReserved": "2026-10-04T22:02:04.892Z", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "datePublished": "2026-10-06T21:35:26.516Z", "assignerShortName": "Gitea"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "gitea.dev", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThanOrEqual": "28.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*", "matchCriteriaId": "A392C59B-D9D1-41C2-BBEC-C0E388C35439", "versionEndExcluding": "28.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service."}], "id": "CVE-2026-104633", "lastModified": "2026-10-13T14:38:56.493", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104633", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-07T15:51:08.820853Z", "version": "2.0.3"}}]}, "published": "2026-10-06T22:17:01.200", "references": [{"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Release Notes"], "url": "https://blog.gitea.com/release-of-28.1.0/"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Patch"], "url": "https://github.com/go-gitea/gitea/pull/39501"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Patch"], "url": "https://github.com/go-gitea/gitea/pull/39507"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Release Notes"], "url": "https://github.com/go-gitea/gitea/releases/tag/v28.1.0"}, {"source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "tags": ["Vendor Advisory"], "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-jj5r-9rpc-8h6h"}], "sourceIdentifier": "88ee5874-cf24-4952-aea0-31affedb7ff2", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-835"}], "source": "88ee5874-cf24-4952-aea0-31affedb7ff2", "type": "Secondary"}]}

{"bugzilla": {"description": "code.gitea.io/gitea: Gitea: Denial of Service via unbounded pagination loop during repository migration", "id": "2547232", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547232"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-835", "details": ["When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service.", "A flaw was found in Gitea. This vulnerability can lead to a Denial of Service (DoS) due to memory exhaustion. When migrating a repository from an external instance, Gitea relies on the source server's reported settings to end paginated downloads. An authenticated user with migration permissions can point the process to a malicious server that returns a page size of zero, triggering an infinite loop that consumes system memory until the service becomes unresponsive."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-104633", "public_date": "2026-10-06T21:35:26Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-104633\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104633\nhttps://blog.gitea.com/release-of-28.1.0/\nhttps://github.com/go-gitea/gitea/pull/39501\nhttps://github.com/go-gitea/gitea/pull/39507\nhttps://github.com/go-gitea/gitea/releases/tag/v28.1.0\nhttps://github.com/go-gitea/gitea/security/advisories/GHSA-jj5r-9rpc-8h6h"], "statement": "A moderate-impact denial of service flaw was found in Gitea, which is included in Red Hat Konflux pipelines-as-code container images (openshift-pipeline/pipelines-pipelines-as-code-controller-rhel9 and openshift-pipeline/pipelines-pipelines-as-code-watcher-rhel9). When migrating a repository from an external Gitea instance, Gitea uses the page size reported in the source server's API settings to end its paginated downloads. An authenticated attacker with permission to migrate repositories could point a migration at a server they control that reports a page size of zero, triggering an unbounded pagination loop that consumes system memory until the service becomes unresponsive. Only availability is affected; there is no impact on confidentiality or integrity (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The affected Konflux components are resolved as deferred because the impact is moderate with a CVSS score below 7.0, and trackers are not filed for moderate severity without a high CVSS score. The residual risk is a denial of service of the affected service, limited to authenticated users who can perform repository migrations against a source server they control.", "threat_severity": "Moderate"}