Gitea's GitLab Migration Process Exposed to Denial of Service Attacks

CVE-2026-60021

What is CVE-2026-60021?

A vulnerability in Gitea's migration functionality allows an authenticated user to exploit a flaw in the migration process when migrating from GitLab. The issue arises from the HTTP client being used without a timeout and the absence of a cancellation context for migration tasks. This permits an attacker-controlled server to maintain an open response indefinitely. As a result, if a migration task is cancelled, the request can continue, leading to exhaustion of the migration worker pool. This prevents other migration tasks from being executed, effectively causing a denial of service for legitimate users who need to perform migrations.

References