CVE-2026-104633

When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported maxresponseitems as 0 made these loops run indefinitely and grow server memory until it was exhausted. Any user who...

EUVD-2026-94062

When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported maxresponseitems as 0 made these loops run indefinitely and grow server memory until it was exhausted. Any user who...

CVE-2026-104633 Gitea migration memory exhaustion from zero page size

When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported maxresponseitems as 0 made these loops run indefinitely and grow server memory until it was exhausted. Any user who...

CVE-2026-104633

A flaw in Gitea allows for a Denial of Service (DoS) via memory exhaustion during repository migrations from another instance. The vulnerability occurs because Gitea relies on the source server's reported max_response_items (or max_response_items) to determine the end of paginated downloads. If a...

CVE-2026-104633: Uncontrolled Resource Consumption

When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported maxresponseitems as 0 made these loops run indefinitely and grow server memory until it was exhausted. Any user who...