The vulnerability arises from an O(N^2) string concatenation performed during the processing of Debian package uploads in Gitea Open Source Git Server. This excessive concatenation can consume vast amounts of CPU time and memory, leading to a DoS that renders the service unavailable or severely degrades its performance. The weakness is identified as improper access control (CWE‑284).

The affected product is Gitea Open Source Git Server. Specific version information is not provided, so all versions prior to a future patch may be vulnerable. The CVE references a new release of version 1.27.0, suggesting that versions before 1.27.0 are at risk, though that is not explicitly confirmed.

The CVSS score is 6.2 and the EPSS score is not available, and the vulnerability is not listed in CISA KEV. Nonetheless, an attacker can exploit the resource exhaustion by uploading a large or specially crafted Debian package through the upload interface. The attack requires the ability to send files to the server; whether authentication is required is unclear, so the risk could be high, especially in publicly exposed installations.