CVE-2026-60021

6.5 Moyenne

Publiée le 14/10/2026 à 17:17 · Modifiée le 18/10/2026 à 16:16 · Analyse NVD reportée · Source : 88ee5874-cf24-4952-aea0-31affedb7ff2

Description

Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.

Traduire en français

Produits concernés

Gitea

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-400

Références

https://blog.gitea.com/release-of-1.27.3/
https://github.com/go-gitea/gitea/pull/39023
https://github.com/go-gitea/gitea/pull/39035
https://github.com/go-gitea/gitea/releases/tag/v1.27.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-5952-x23q-p23f

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories