Gitea EUVD-2026-93920

Requires an authenticated Gitea account (version ≤1.27.3) with permission to create issues or post comments; the attacker submits a large (~1 MB) issue/comment body whose structure maximizes Markdown links, exploiting the per-link rescan for close/reopen keywords. No special non-default configuration is needed and no user interaction is required (UI:N), but exploitation is limited by the authentication requirement (PR:L) and by any restrictions on account registration or issue/comment creation; instances that forbid self-registration or limit who can open issues meaningfully constrain who can trigger it.

This is a moderate, authentication-gated denial-of-service issue (CWE-407, algorithmic complexity) rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5) is internally consistent with the description: a network-reachable, low-complexity attack requiring a valid authenticated account that can submit issue or comment content, with impact limited purely to availability (C:N/I:N). All corroborating signals point to low real-world urgency: EPSS is 0.16% (4th percentile), there is no CISA KEV listing, and SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial. No public exploit code was identified - the only source-code artifact provided is the upstream fix (PR #39396 introducing a bounded keyword window), not a weaponized POC. One signal to weigh carefully: CVSS rates A:H, while SSVC calls technical impact only 'partial' and the description scopes the effect to one busy CPU core plus a held database transaction for several minutes - this is a degradation/resource-exhaustion condition, more consistent with A:L in practice, so A:H may slightly overstate severity for a single request (though repeated requests could compound into a broader outage). The PR:L requirement is the main limiter: an attacker needs the ability to post issues/comments, so instances that disable public registration or restrict issue creation materially reduce exposure.

An attacker with (or who self-registers) an authenticated Gitea account opens an issue or posts a comment containing a crafted body of roughly 1 MB structured to maximize Markdown links preceded by long text. Because reference parsing rescans all preceding text for action keywords ('closes', 'fixes') once per link, processing becomes quadratic, pinning a CPU core for several minutes and holding a database transaction open; repeating this across accounts or requests degrades availability for the whole instance. No public exploit code is known, but the quadratic trigger is simple to reproduce.