An unauthenticated ReDoS (Regular Expression Denial of Service) flaw occurs when Gitea processes CODEOWNERS files. During pattern matching the server evaluates a by the requester, and a crafted pattern can force excessive CPU consumption. An attacker can trigger this by sending a malicious pattern through an unauthenticated request to any repository, causing the serverresponsive and denying service to all users. The weakness corresponds to CWE‑284, a control that permits unauthenticated users to execute a computationally expensive routine.

The vulnerability affects the Gitea Open Source Git Server. The advisory does not specify an exact version range that is affected. It references a fix after the release of 1.26.4, however it does not confirm that the patch is included in that release. Thus, at this time it is unclear which specific releases contain the fix and which remain vulnerable. Versions prior to 1.26.4 are potentially exposed.

The the EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is an una the CODEOWNERS parsing endpoint. Because the flaw can be triggered without authentication, an instance can cause a denial of service, making the vulnerability potentially exploitable, especially in public or permissively exposed deployments. The system remains at risk for denial of service, but current exploitation trends appear limited due to the low EPSS. The CVSS score for this vulnerability is 7.5, indicating a high severity level.