The vulnerability exists in Gitea Open Source Git Server versions older than 1.25.5. When users create a repository, the system does not enforce length or format constraints on fields such as template descriptors, trust model tags, or object format identifiers. Malformed or excessively long values supplied by an attacker can trigger application errors, consume excessive resources, or result in improper trust assignments. The weakness is categorized as CWE‑20, improper input validation.

All Gitea installations running a version prior to 1.25.5 are affected. The issue was addressed in release 1.25.5, which adds validation checks for the relevant fields; versions 1.25.5 and later are not vulnerable.

The repository creation endpoint requires authentication, so exploitation requires access to an account with repository creation privileges. No public exploit has been reported and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score is below 1%, indicating a low probability of widespread exploitation, although the lack of validation could still cause denial of service or misconfigured trust settings if an attacker can reach the endpoint.