What is the CVSS score of CVE-2026-26307?

CVE-2026-26307 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Gitea are affected by CVE-2026-26307?

Gitea versions prior to 1.25.5 contain an uncontrolled resource consumption vulnerability enabling unauthenticated remote denial of service attacks through CPU exhaustion via code search operations.. A patch is available.

How to fix or mitigate CVE-2026-26307?

Within 24 hours, inventory all Gitea instances in your environment and identify those running versions before 1.25.5. Within 7 days, apply the vendor-released patch to upgrade all affected instances to Gitea 1.25.5 or later, testing in a staging environment and preparing a rollback procedure. Within 30 days, verify patch deployment across all systems, review access logs for patterns of repeated expensive search queries, and confirm rate-limiting or query timeout protections are enabled on the code search endpoint.

Gitea CVE-2026-26307

EUVD-2026-41631 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-03 Gitea

GHSA-h9c5-x7g8-4q7f

Denial Of Service Gitea Gitea Open Source Git Server

7.5

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable search with low complexity, no auth or interaction in default public-search deployments, and availability-only resource-exhaustion impact (C:N/I:N/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 18:32 vuln.today

Analysis Generated

Jul 22, 2026 - 18:32 vuln.today

CVE Published

Jul 03, 2026 - 20:19 cve.org

HIGH 7.5

CVE Published

Jul 03, 2026 - 20:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.

AnalysisAI

Uncontrolled resource consumption in Gitea before 1.25.5 allows remote attackers to exhaust server CPU by triggering unbounded 'git grep' code searches that ran without any execution timeout. Because the search endpoint is network-reachable and the CVSS vector (PR:N) indicates no authentication is required, an attacker can repeatedly submit expensive regex/pattern searches against hosted repositories to degrade or deny service. No public exploit identified at time of analysis, and EPSS is low (0.18%), but SSVC marks the flaw as automatable with partial technical impact.

Technical ContextAI

Gitea is a self-hosted, lightweight Git service (a Go-based alternative to GitHub/GitLab) whose code-search feature shells out to the underlying 'git grep' command. The root cause is CWE-400 (Uncontrolled Resource Consumption): the GrepSearch implementation in modules/git/grep.go invoked git grep without an execution deadline, so a sufficiently expensive search pattern over large repositories could run indefinitely and pin server resources. The upstream fix (PR #36809) introduces a 30-second grepSearchTimeout constant and wires it into the git command via WithTimeout(), bounding each search; PR #36835 is a related follow-up. The affected CPE is cpe:2.3:a:gitea:gitea_open_source_git_server, confirming the Gitea server product itself rather than a plugin or dependency.

RemediationAI

Upgrade to Gitea 1.25.5 or later, which adds a 30-second timeout to git grep searches (Vendor-released patch: 1.25.5; upstream fixes in https://github.com/go-gitea/gitea/pull/36809 and https://github.com/go-gitea/gitea/pull/36835, release notes at https://blog.gitea.com/release-of-1.25.5/). If you cannot upgrade immediately, reduce exposure by restricting or disabling anonymous access to code search - require authentication for repository browsing/search so unauthenticated users cannot trigger searches (trade-off: hampers public/open repositories that rely on open search). Additionally, place Gitea behind a reverse proxy and rate-limit requests to the search endpoints and enforce request/connection timeouts (trade-off: aggressive limits may throttle legitimate heavy users), and consider limiting search on very large repositories. These are compensating controls only; applying 1.25.5 is the definitive fix.