CVE-2026-104633
Description
A flaw was found in Gitea. This vulnerability can lead to a Denial of Service (DoS) due to memory exhaustion. When migrating a repository from an external instance, Gitea relies on the source server's reported settings to end paginated downloads. An authenticated user with migration permissions can point the process to a malicious server that returns a page size of zero, triggering an infinite loop that consumes system memory until the service becomes unresponsive.
Statement
A moderate-impact denial of service flaw was found in Gitea, which is included in Red Hat Konflux pipelines-as-code container images (openshift-pipeline/pipelines-pipelines-as-code-controller-rhel9 and openshift-pipeline/pipelines-pipelines-as-code-watcher-rhel9). When migrating a repository from an external Gitea instance, Gitea uses the page size reported in the source server's API settings to end its paginated downloads. An authenticated attacker with permission to migrate repositories could point a migration at a server they control that reports a page size of zero, triggering an unbounded pagination loop that consumes system memory until the service becomes unresponsive. Only availability is affected; there is no impact on confidentiality or integrity (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The affected Konflux components are resolved as deferred because the impact is moderate with a CVSS score below 7.0, and trackers are not filed for moderate severity without a high CVSS score. The residual risk is a denial of service of the affected service, limited to authenticated users who can perform repository migrations against a source server they control.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
