CVE-2026-60021 in Gitea
Summary
by MITRE • 10/15/2026
Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability in Gitea stems from a critical flaw in its GitLab migration module, specifically within the initial version probe mechanism used to detect compatible repositories during the import process. When an authenticated user initiates a migration task targeting an external server, the application constructs an HTTP client that lacks any configured timeout settings for connection or response operations. Furthermore, this HTTP request is not bound to the cancellation context of the underlying migration task. This architectural oversight means that once the network call is initiated, it operates independently of the lifecycle management controls designed to terminate long-running or problematic tasks.
An attacker who possesses valid authentication credentials and permission to start migrations can exploit this behavior by directing a migration target toward a server under their control. By configuring this external server to accept the connection but delay sending an HTTP response indefinitely, the attacker forces Gitea's internal worker process to remain blocked on that specific network call. Because there is no timeout mechanism to forcibly close the connection after a reasonable duration, and because the cancellation context is not attached to the request object, the migration task cannot be effectively terminated even if the user attempts to cancel it or if an administrator intervenes.
The operational impact of this flaw is significant as it leads directly to resource exhaustion within the Gitea application server. Each blocked migration attempt consumes one worker from the limited pool dedicated to handling background tasks such as migrations, webhooks, and other asynchronous operations. Since these workers are held indefinitely by the unresponsive attacker-controlled server, they become unavailable for legitimate processing. This results in a denial of service condition where new migration requests queue up or fail immediately due to lack of available resources, effectively halting productivity for all users relying on the platform's integration capabilities.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, and more specifically relates to improper handling of connection timeouts that can lead to thread starvation. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1496, Resource Hijacking, where an adversary uses computing resources for their own purposes or causes a denial of service by exhausting system capacity through inefficient resource management practices within the application logic.
To mitigate this risk, it is imperative to implement strict timeout configurations on all HTTP clients used during external communications, particularly those involved in migration probes and data fetching operations. The default timeout values should be set to reasonable limits that balance user experience with security requirements, ensuring that connections are closed if a remote server fails to respond promptly. Additionally, the code must ensure that every outgoing HTTP request is explicitly tied to the task's context object using standard Go patterns such as passing the context to http.NewRequestWithContext or similar mechanisms in other languages. This ensures that when a migration task is cancelled by the user or timed out by the system, the underlying network connection is also terminated immediately, preventing worker pool exhaustion and maintaining service availability for legitimate operations.