Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, which allows an attacker to submit search queries that consume excessive CPU and memory. This resource‑exhaustion flaw (CWE‑400) can degrade or halt the server’s availability, affecting all users accessing the service.

The vulnerability affects the Gitea Open Source Git Server, specifically installations running any version earlier than 1.25.5. 1.25.5 and later releases include the timeout fix and are not affected.

The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the flaw is not listed in the CISA KEV catalog, suggesting low likelihood of active exploitation. The CVSS score of 7.5 reflects a moderate‑to‑high severity. Based on the description, the likely attack vector is through any interface that accepts git grep requests—most plausibly the web UI or REST API—allowing both authenticated and potentially unauthenticated users to initiate costly searches if not restricted.