Gitea's OneDev migration downloader mishandles responses from the target server. The code reads every byte of the upstream response into memory without enforcing a size limit and relies on an HTTP client that lacks a timeout. When an authenticated user initiates a migration pointing to a malicious or misconfigured OneDev-compatible server, the downloader can be forced to buffer an arbitrarily large or indefinitely streaming response. The result is uncontrollable memory growth and the occupation of migration workers, which can lead to service outages for other Git operations.

The affected vendor is Gitea, with its single source code repository hosting product "Gitea". No explicit version ranges are listed in the CNA data; however, the remedy references a release v1.27.3, implying that versions before v1.27.3 are vulnerable. Administrators should verify their current Gitea version and consider updating to v1.27.3 or later where the downloader size checks and timeout handling have been implemented.

The CVSS score of 6.5 indicates moderate severity. Because the vulnerability requires an authenticated user to start a migration, the likelihood of exploitation depends on the depth of the user's permissions. Attackers could create the necessary migration job and direct it to a malicious server, allowing them to exhaust system resources or block legitimate traffic. The EPSS score of < 1% indicates a very low exploitation probability, and the issue is not listed in the CISA KEV catalog, but the memory exhaustion potential still warrants prompt remediation.