Description
Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.
References (4)
Core 4
Core References
Release Notes release-notes
Gitea v1.25.5 Release
https://github.com/go-gitea/gitea/releases/tag/v1.25.5
Release Notes release-notes
Gitea v1.25.5 Release Blog Post
https://blog.gitea.com/release-of-1.25.5/
Scores
CVSS v3
7.5
EPSS
0.0047
EPSS Percentile
38.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-400
Status
published
Products (1)
Gitea/Gitea Open Source Git Server
< 1.25.5
Published
Jul 03, 2026
Tracked Since
Jul 04, 2026