Gitea EUVD-2026-41604

The specific prerequisite is that the target Gitea instance processes CODEOWNERS pattern matching against attacker-influenced input - the vulnerable code path is the CODEOWNERS regex evaluation. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires no authentication, no user interaction, and only network reachability to the Gitea HTTP service, so any internet-exposed instance older than 1.26.3 is exposed. The limiting factors are: the attacker must be able to reach an endpoint that invokes CODEOWNERS processing, the affected version must predate the 1.26.3/1.26.4 fix, and the impact is confined to availability (service slowdown/outage) with no confidentiality or integrity effect.

Signals are internally consistent for a network-facing DoS but not a top-tier emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U, C:N/I:N/A:H) scores 7.5 High and indicates remote, low-complexity, unauthenticated abuse affecting availability only - no data confidentiality or integrity loss. EPSS is low (0.16%, 6th percentile), there is no KEV listing and no POC referenced, so this is a plausible-but-not-yet-observed threat rather than an active campaign. The 'Authentication Bypass' tag in the intelligence conflicts with the description and the CVSS PR:N/A:H profile (a pure DoS, not an auth bypass) - treat that tag as mislabeled and rely on the ReDoS/DoS framing. Practical priority is moderate: patch promptly on internet-exposed Gitea instances, but this is an availability nuisance, not a code-execution or data-breach risk.

An attacker reachable over the network sends a request that causes Gitea to evaluate a crafted CODEOWNERS pattern, triggering catastrophic regex backtracking that pegs a CPU core; repeating the request in parallel starves the server and denies service to legitimate users. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required, though no public proof-of-concept has been identified at time of analysis.