CVE-2026-60018: Gitea OneDev migration denial of service
Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout. An authenticated user who can start a repository migration can direct it to an attacker-controlled OneDev-compatible server returning an oversized or never-ending response. This can consume memory and hold migration workers, impairing service availability.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the issue?
An authenticated user who is permitted to start a repository migration can trigger it. The user must be able to set the migration source to an attacker-controlled OneDev-compatible server.
What must the malicious migration source do to cause disruption?
It can return an oversized response to consume memory, or a response that never finishes to keep migration workers occupied. Either condition can impair service availability.