CVE-2026-60021
Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not…
- Risk score
- 48/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancell…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing.
Last activity 14 Oct 2026. Patch Forecast updates every hour.