UNKNOWN NVD
CVE-2026-104633
When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A
When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads. A source that reported `max_response_items` as `0` made these loops run indefinitely and grow server memory until it was exhausted. Any user who can migrate repositories could point a migration at a server they control and cause a denial of service.
References
- https://blog.gitea.com/release-of-28.1.0/
- https://github.com/go-gitea/gitea/pull/39501
- https://github.com/go-gitea/gitea/pull/39507
- https://github.com/go-gitea/gitea/releases/tag/v28.1.0
- https://github.com/go-gitea/gitea/security/advisories/GHSA-jj5r-9rpc-8h6h
This unknown severity vulnerability was published on 2026-10-06 via NVD.
vulnfeed aggregates 9512 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.