CVE-2026-60021 Details
Description
Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.
A denial-of-service vulnerability has been identified in Gitea's GitLab migration feature, specifically in versions 1.16.0 through 1.27.2. The issue arises because the initial version probe to GitLab's API is made without a timeout and without attaching the migration task's cancellation context. This allows an authenticated user to target an attacker-controlled server that keeps the response open indefinitely. As a result, the request can bypass task cancellation, leading to exhaustion of the migration worker pool and causing delays in other migration processes.
Users can upgrade to Gitea version 1.27.3, which addresses this vulnerability by canceling the GitLab version probes and restoring proper task management. Instructions for upgrading are available in the Gitea documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-1.27.3/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39023 | Gitea Limited | Source CodeVendor |
| https://github.com/go-gitea/gitea/pull/39035 | Gitea Limited | Source CodeVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.3 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-5952-x23q-p23f | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | >= 1.16.0, <= 1.27.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | Gitea Limited |