Memory Consumption Vulnerability in Gitea's OneDev Migration Downloader

CVE-2026-60018

What is CVE-2026-60018?

The Gitea OneDev migration downloader contains a vulnerability that allows an authenticated user to exploit its handling of remote version responses. It reads the entire response into memory without a size constraint and utilizes a client that lacks a timeout feature. This can result in the server being directed to a malicious OneDev-compatible server that might return an excessively large or indefinite response. When exploited, this vulnerability can lead to high memory consumption, causing migration workers to become unresponsive and adversely affecting the overall service availability.

References