The vulnerability occurs when a repository’s external issue tracker regular expression contains alternating capture groups. During rendering of issue references, the regex can produce invalid slice indexes that cause a runtime panic that terminates the Gitea process. This results in a denial of service for all users on the instance.

The affected product is Gitea, the self‑hosted Git service. No specific version range is provided in the advisory; administrators should verify whether the system runs a version before the 28.0.0 release and apply the fix if needed.

An attacker must have permission to edit a repository’s external issue tracker settings to exploit the flaw. Once configured, any subsequent rendering of content that matches the malicious pattern—such as viewing a README—will crash the entire application. The CVSS score is 7.5, indicating a high severity, and the EPSS score is less than 1%, suggesting a low likelihood of exploitation, though the vulnerability is not listed in CISA’s KEV catalog. Without a patch, the risk remains high for systems that have not yet upgraded. The potential for an uncontrolled crash makes this a severe availability threat.