Gitea does not enforce a maximum length on the gitignores field supplied during repository creation via the web form or API. The server processes this field by splitting it into template names, repeatedly resolving each template, and loading the corresponding contents into memory. An attacker who can create repositories can submit an excessively long gitignore value, causing the server to perform many template lookups and allocate large buffers. This activity can overwhelm available memory, leading to degraded performance or a crash that denies service to all users.

The flaw affects the Gitea project. Any instance running a version prior to the 1.27.3 release is vulnerable, as that version contains the patch that restricts the size of the gitignores input. System administrators should review their deployed Gitea version and plan an upgrade accordingly.

The CVSS score of 4.3 indicates moderate severity. Because the EPSS score is 0.00366 (<1%) and the vulnerability is not listed in the CISA KEV catalog, the current exploitation probability is presumably low, but an attacker who can create a repository can trigger the DoS condition purely through legitimate API usage, so the attack vector is remote. The lack of controls on input size makes the vulnerability relatively easy to exercise without special privileges.