This vulnerability allows an attacker to trigger a quadratic‑time parsing loop in the Locale middleware by sending a specially crafted Accept‑Language header. When an unauthenticated request reaches the middleware, the parsing of this header can consume excessive CPU time, leading to a denial of service for legitimate users. The flaw is a classic example of algorithmic complexity abuse (CWE‑407) combined with a specific locale parsing error (CWE‑1333).

The affected product is Gitea Open Source Git Server. Version information is not explicitly listed in the CVE data, but the advisory references suggest that the issue was resolved in the 1.27.0 release. Any Gitea instance running a pre‑1.27.0 version and exposing the Locale middleware to unauthenticated traffic is potentially vulnerable.

The exploit requires only the ability to send an HTTP request to the target, with no authentication needed, making the attack vector straightforward. The CVSS score of 7.5 indicates a high severity, and the EPSS score of <1% suggests that widespread exploitation is unlikely at present; the vulnerability is not listed in CISA’s KEV catalog. Although the exploitation probability is low, the DoS effect can still throttle server resources and produce noticeable service degradation or temporary denial for users. An attacker could launch automated high‑volume requests to trigger repeated parsing of malicious Accept‑Language headers, amplifying the DoS impact.