TI-2026-74002 Aliases CVE-2026-60021

Gitea GitLab migration probe can exhaust migration workers

LOW 30CWE-400Published 2026-10-14 · Updated 2026-10-18

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-400.

Summary

Gitea versions from 1.16.0 before 1.27.3 send the initial GitLab migration version probe with an HTTP client that has no timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can point the migration at an attacker-controlled server that keeps the response open indefinitely. The request keeps running after the task is cancelled, which can exhaust the migration worker pool and stop other migrations from progressing. This is classified as CWE-400, Uncontrolled Resource Consumption.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00548 46th percentileScored 2026-11-07

Fix Fixed Gitea (Gitea): 1.27.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Gitea	Gitea	1.16.0 to before 1.27.3	1.27.3	Patch available	CNA

Gitea VendorGitea Affected 1.16.0 to before 1.27.3 Fixed in 1.27.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:gitea:gitea::::::::	—	—	Gitea

cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:* Versions — — ·Gitea

Remediation

Gitea versions from 1.16.0 before 1.27.3 are fixed in 1.27.3. Upgrade Gitea to version 1.27.3 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Gitea (Gitea) Fixed in 1.27.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-14
Gitea 1.27.3
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-74001 Gitea OneDev migration denial of servicePriority LOW 30
Show all 2 records →

Timeline

2026-10-14 Threatist record created from CVE-2026-60021
2026-10-18 CVSS score added · CISA ADP
2026-10-18 CISA SSVC decision points changed

References

Patch 2

Advisory 1

GitHub Security Advisory GHSA-5952-x23q-p23f

Other 2

TI-2026-42785 Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. KEVCVSS 3.1CRITICAL 9.8
TI-2026-42033 Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts CVSS 3.1CRITICAL 9.8
TI-2026-40842 Privilege Escalation via Access Token Scope Escalation in API CVSS 3.1CRITICAL 9.8
TI-2026-16922 Gitea Docker image trusts spoofable reverse-proxy headers by default CVSS 3.1CRITICAL 9.8
TI-2026-42043 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting CVSS 3.1CRITICAL 9.1
TI-2026-40381 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes CVSS 3.1CRITICAL 9.1

See all 240 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences