CVE-2026-60021

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The initial GitLab migration version probe utilizes an HTTP client that lacks a timeout and fails to attach the migration task's cancellation context. An authenticated user capable of initiating migrations can target a server under attacker control that maintains an open response indefinitely. This causes the request to persist even after the task is cancelled, which can lead to the exhaustion of the migration worker pool and block other migration processes from progressing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.