Gitea's migration process creates an HTTP request to the target GitLab instance without specifying a timeout and does not honour the cancellation context. If an attacker controls the target server and keeps the response open, the worker that handles the migration continues to wait for the response even after the task is cancelled. This can exhaust the pool of available migration workers, blocking subsequent migration jobs and effectively denying service to users who rely on that functionality. The weakness is an uncontrolled resource consumption flaw (CWE‑400).

The vulnerability affects the Gitea application. Specific affected versions are not listed in the available data; users should verify that they are running an older release prior to v1.27.3 and consider updating accordingly.

Based on the description, the likely attack vector is an authenticated user with migration permissions initiating a migration to an attacker‑controlled GitLab instance that keeps the response open indefinitely. The absence of a timeout and context cancellation is inferred to allow the task to continue running after cancellation, exhausting migration workers. Although the EPSS score is reported as less than 1%, the analysis infers a high‑impact denial of service because the exhaustion of workers can block all subsequent migration jobs on the affected instance. The vulnerability is not listed in the CISA KEV catalog, and no CVSS score is supplied, but the potential to deny migration services justifies treating the flaw as a severe local‑to‑remote denial of service that could affect many users on the instance.