The vulnerability in Gitea allows a user to trigger the server to perform DNS lookups for arbitrary domain names during repository migration. By sending a repository migration request that resolves to multiple DNS answers, an attacker can bypass the server's allow‑list filtering. This enables an attacker to access internal network resources or reveal sensitive server information, which is consistent with CWE‑918 (Server Side Request Forgery) and CWE‑200 (Information Exposure).

The affected product is the Gitea Open Source Git Server. No specific version numbers are listed in the advisory, so any Gitea installation that supports repository migration may be impacted.

The exploit requires only an HTTP request to the migration endpoint; thus the attack vector is remote over the network. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, making it unclear how frequently it is targeted. Because no CVSS score is provided, the severity must be inferred from the potential for internal reconnaissance. Administrators should treat it as a moderate‑to‑high risk until a patch is applied.