This vulnerability allows an attacker to trigger a quadratic‑time parsing loop in the Locale middleware by sending a specially crafted Accept‑Language header. When an unauthenticated request reaches the middleware, the parsing of this header can consume excessive CPU time, leading to a denial of service for legitimate users. The flaw is a classic example of algorithmic complexity abuse (CWE‑407) combined with a specific locale parsing error (CWE‑1333).

The affected product is Gitea Open Source Git Server. Version information is not explicitly listed in the CVE data, but the advisory references suggest that the issue was resolved in the 1.27.0 release. Any Gitea instance running a pre‑1.27.0 version and exposing the Locale middleware to unauthenticated traffic is potentially vulnerable.

The exploit requires only the ability to send an HTTP request to the target, with no authentication needed, which makes the attack vector straightforward. Because EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, the numeric severity cannot be precisely quantified; nevertheless, the ability to throttle server resources can lead to noticeable service degradation or temporary denial for users. An attacker could launch automated high‑volume requests to trigger repeated parsing of malicious Accept‑Language headers, amplifying the DoS impact.