The vulnerability is located in Gitea's SSH key parser, allowing an attacker to submit crafted key input that can exhaust processing resources and cause the server to become unresponsive. This results in a denial of service to legitimate users, impacting availability of the Git hosting service. The weakness involves improper access control that fails to validate or limit the size and format of SSH key data being parsed.

The affected product is Gitea Open Source Git Server. Exact version information is not disclosed; the issue is reported against recent releases around the time of the 1.27.0 release. All current deployments of Gitea at the time of disclosure could be vulnerable until a patch is applied.

The public CVSS score is 6.2, and EPSS data is unavailable, so the precise likelihood of exploitation cannot be quantified. The vulnerability is not included in the CISA KEV catalog, indicating no known active exploitation publicly. However, because the attack vector likely involves sending malicious SSH key data over the network, remote attackers could trigger the denial of service by repeatedly flooding the key parser. The actual impact depends on the application's ability to handle malformed input and the presence of any rate limiting.