CVE-2026-104633

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description During repository migration from another Gitea instance, the software uses the page size reported by the source server's API to manage paginated downloads. If a source server reports the max response items variable as 0, it triggers an infinite loop that consumes server memory until it is exhausted, leading to a denial of service. This can be exploited by a user initiating a migration from a server under their control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.