The vulnerability arises when Gitea performs repository migrations and relies on the source server's reported max_response_items to bound paginated downloads. If the source reports a value of zero, the pagination loop continues forever, consuming memory until the server runs out. This results in a denial of service that can affect all users of the instance. The weakness corresponds to resource exhaustion and infinite loop, and attackers that can initiate migrations can target a server they control to trigger the exploit.

Vendors: Gitea; Product: Gitea. All versions prior to the 28.1.0 release are vulnerable, as the fix was introduced in that version.

The CVSS score of 6.5 indicates a moderate severity DoS flaw that can be triggered by any user with migration privileges. The EPSS score of less than 1% suggests a low but nonzero likelihood that attackers will attempt to exploit this vulnerability. Because the issue is not listed in the CISA KEV catalog, it is currently considered unpublicly exploited, but the lack of a safeguard on max_response_items means exploitation can occur if a malicious source server reports zero. The attack can be performed by initiating a migration against a controlled server, causing memory exhaustion and downtime for the target instance.