Gitea CVE-2026-104633

Requires an authenticated Gitea account with permission to migrate repositories (PR:L) AND the ability to direct that migration at a source server the attacker controls or can manipulate so its settings API returns max_response_items=0, which causes the paginated download loop to run indefinitely. Limiting factors: migration must be enabled and available to the attacker's account, and the attacker must control the source server's reported API settings - it is not exploitable against a default install by an unauthenticated outsider. Affected versions are Gitea ≤ 28.0.0; fixed in 28.1.0.

This is a genuine but moderate-priority availability issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: exploitation is network-reachable and low-complexity, but requires an authenticated account (PR:L) with repository-migration privileges, and impact is confined to availability (A:H) with no confidentiality or integrity effect - appropriate for a CWE-400 uncontrolled resource consumption flaw. The real-world signals argue AGAINST treating this as urgent: EPSS is only 0.17% (5th percentile), the CVE is NOT on CISA KEV, and no public exploit code is referenced in the input. Exploitation status is therefore 'no public exploit identified at time of analysis.' The main caveat is a limiting factor the CVSS does not fully capture - the attacker must be able to initiate a migration AND control (or spoof) the source Gitea server's API settings to report max_response_items=0, so this is realistically an abuse-by-authorized-user or malicious-outbound-migration scenario rather than mass opportunistic exploitation. Net: patch in normal cadence; prioritize higher if migration is open to untrusted/low-trust users.

An attacker with a Gitea account that is permitted to migrate repositories stands up a server they control (or a malicious API endpoint) whose settings API reports max_response_items as 0. They start a repository migration from their own Gitea instance pointing at that server; the paginated download loop never terminates, growing server memory until the host is exhausted and Gitea becomes unavailable to all users. No public proof-of-concept is referenced in the available data; exploitation is network-based and low-complexity but requires an authenticated, migration-capable account.