Description
When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Gitea | Gitea | ≤ 28.0.0 | — |
Advisories 1
- WID-SEC-2026-3792 Gitea: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2026
References
- GitHub Security Advisory GHSA-jj5r-9rpc-8h6h vendor-advisory
- Fix: go-gitea/gitea pull request #39501 patch
- Fix backport to release/v28: go-gitea/gitea pull request #39507 patch
- Gitea 28.1.0 release announcement release-notes
- go-gitea/gitea v28.1.0 release release-notes