Description
Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
Published: 2026-07-03
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated Regular Expression Denial of Service (ReDoS) flaw exists in Gitea when processing CODEOWNERS files. During pattern matching the server evaluates input supplied by a requester, and a crafted regular expression can consume excessive CPU resources. An attacker can trigger the bug by sending a malicious pattern from an unauthenticated request against any repository, causing the server to become unresponsive and denying service to all users. The weakness is catalogued as CWE‑284, a control that permits unauthenticated users to execute a computationally expensive routine.

Affected Systems

The flaw affects Gitea Open Source Git Server releases 1.26.3 and earlier. The advisory mentions that the fix is included in release 1.26.4, so only instances running a version older than 1.26.4 are vulnerable.

Risk and Exploitability

The EPSS score is less than 1 %, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.5 classifies the issue as high severity. The attack vector is inferred to be an unauthenticated request to the CODEOWNERS parsing endpoint, which does not require authentication and can be triggered from any network location. While exploitation is currently rare, the high impact on availability warrants immediate attention.

Generated by OpenCVE AI on August 3, 2026 at 05:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Gitea to version 1.26.4 or later, which contains the fix for the ReDoS vulnerability.
  • If an upgrade cannot be performed immediately, remove or disable CODEOWNERS file processing for all repositories or restrict access to the directories containing these files to limit exposure.
  • Implement request throttling or CPU usage limits on the API endpoint that processes CODEOWNERS to mitigate potential denial‑of‑service impact.

Generated by OpenCVE AI on August 3, 2026 at 05:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-v96j-25gv-g2w9 Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Gitea
Gitea gitea Open Source Git Server
Vendors & Products Gitea
Gitea gitea Open Source Git Server

Mon, 06 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Description Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
Title Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
Weaknesses CWE-284
References

Subscriptions

Gitea Gitea Open Source Git Server
cve-icon MITRE

Status: PUBLISHED

Assigner: Gitea

Published:

Updated: 2026-07-06T15:12:29.175Z

Reserved: 2026-06-30T18:57:20.614Z

Link: CVE-2026-58421

cve-icon Vulnrichment

Updated: 2026-07-06T15:12:17.042Z

cve-icon NVD

Status : Deferred

Published: 2026-07-03T21:17:05.347

Modified: 2026-07-06T18:18:46.870

Link: CVE-2026-58421

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T05:30:17Z

Weaknesses