Gitea parses the bodies of issues and comments to detect action keywords such as "closes" or "fixes". For each Markdown link in the text, the parser scans the entire content, causing processing time that grows quadratically with input length. An authenticated user can submit a payload of about one megabyte, keeping a CPU core busy for minutes while holding a database transaction, which renders the service unavailable to other users and locks database resources, effectively creating a denial‑of‑service.

This vulnerability targets the Gitea software, specifically its issue and comment body parsing logic. All releases before the 28.0.0 version are affected, as the fix was introduced in that release. Production deployments running an older version should verify their current release and apply the patch when possible.

The flaw requires the attacker to be authenticated to the Gitea instance to submit the crafted issue or comment. The CVSS score of 6.5 indicates a medium severity, and the EPSS score of < 1% shows a low probability of exploitation in the near term. Consequently, the likelihood of attack remains uncertain, but the potential impact is significant because the payload can keep a CPU core busy for minutes and lock database resources, disrupting service availability. The vulnerability is not listed in the CISA KEV catalog, indicating no documented large‑scale exploitation yet.