CVE-2026-60021 | BDVDB-2026-388909 Detail

Description#

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-14Record published in the CVE List.
2. Version 22026-10-18Most recent update recorded in the CVE List.