CVE-2026-60021: Gitea GitLab migration denial of service
Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has permission to start GitLab migrations can exploit it by directing a migration at an attacker-controlled server.
What attacker-controlled behavior triggers the denial of service?
The attacker-controlled server keeps the version-probe HTTP response open indefinitely. Because the client has no timeout and does not use the migration task's cancellation context, the request remains active even after cancellation.
What is the operational impact?
Stuck migration requests can exhaust the migration worker pool, preventing other migrations from making progress.