CVE-2026-104633

Executive Summary

CVE-2026-104633 is a denial-of-service vulnerability in Gitea, the self-hosted Git service, arising from improper handling of paginated API responses during repository migration. When a migration source server reports max_response_items as 0, Gitea's pagination loops run unbounded, exhausting server memory. Any authenticated user with repository migration privileges can trigger this by pointing a migration at an attacker-controlled server, causing a denial of service.

Technical Analysis

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). The core mechanism is a resource-exhaustion condition driven by externally supplied configuration data. Gitea's repository migration feature allows users to import repositories from another Gitea instance by querying that instance's API. During migration, Gitea performs paginated downloads, using the page size reported in the source server's API settings to determine when to end the pagination loop.

The flaw is that the loop termination logic trusts a numeric value (max_response_items) supplied by the source server. When that value is 0, the pagination arithmetic does not produce a valid terminating condition. Each iteration continues to allocate and retain data in memory, and because the loop never concludes, memory consumption grows monotonically until the server process is exhausted. This is a classic unbounded-loop / memory-exhaustion pattern: rather than a buffer overflow or injection flaw, the defect is a missing input-validation guard on a remote-controlled integer used as a loop boundary.

Several properties make this exploitable:

• Attacker-controlled input: The migration source is specified by the user; an attacker can host a modified or minimal API responder that advertises max_response_items: 0.
• Low authentication bar: The NVD description states "Any user who can migrate repositories" can trigger it — meaning a low-privileged, authenticated account suffices.
• Network reachable: The trigger is a normal, legitimate application feature, so no malformed protocol traffic or memory-corruption primitive is required.

No specific function names, routes, or code paths are asserted here beyond what the NVD description provides; the description references the migration subsystem and the API settings field max_response_items. No public patch, vendor advisory, or commit reference was available at the time of writing, so affected version ranges cannot be precisely enumerated.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description, and does not rely on any fabricated identifiers.

1. Reconnaissance / target identification: The attacker identifies a Gitea instance and confirms they hold an account with permission to create repository migrations. This is typically a low-privilege, authenticated role. The attacker also prepares a server they control that speaks the Gitea API migration handshake and deliberately reports max_response_items as 0 in its API settings response.

2. Triggering the flaw: The attacker initiates a repository migration from their controlled source into the target Gitea instance. During the migration handshake, Gitea reads the source's reported max_response_items value and adopts it as the page size governing the paginated download loop. Because the value is 0, the loop's termination computation fails to converge, and Gitea repeatedly issues and processes page fetches.

3. Execution / resource consumption: Each iteration causes the server to allocate and retain additional memory. As the loop is unbounded, memory growth continues until the Gitea process — or the host — exhausts available memory. No malicious payload is delivered; the "payload" is the deceptive configuration value returned by the attacker's server. The attack is repeated or sustained as needed to keep the service unavailable.

4. Post-exploitation impact: The primary effect is denial of service: the Gitea instance becomes unresponsive to legitimate users, and dependent Git operations (clone, push, pull, web UI) fail. Collateral impact can include operating-system-level OOM-killer activity and disruption of co-hosted services on the same host. Depending on deployment and instance size, recovery may require a restart and, in severe cases, host-level intervention.

Impact Assessment

• Business impact: A successful exploit renders a Gitea instance unavailable, interrupting source-control operations for all users and dependent CI/CD pipelines. Because the trigger requires only a low-privileged authenticated account, the barrier to attack is low.
• Affected systems: Any Gitea deployment that exposes the repository migration feature to non-administrative users is in scope. Instance size determines recovery time.
• Blast radius: Denial of service is instance-wide (all repositories, all users), not limited to the migrating user's namespace. If Gitea shares a host with other services, memory exhaustion can spill over to those services.
• CVSS subscores (inferred vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): Network attack vector (AV:N), Low attack complexity (AC:L), Low privileges required (PR:L), No user interaction (UI:N), Unchanged scope (S:U), No confidentiality impact (C:N), No integrity impact (I:N), High availability impact (A:H). Note: the authoritative CVSS score for CVE-2026-104633 is N/A; the vector above is inferred for analytical purposes only. EPSS has not been scored by FIRST.org.

Detection Guidance

Sigma Rule

title: Potential Gitea Migration Memory Exhaustion (CVE-2026-104633)
id: 8f3b2c14-9a7e-4d6a-b3f2-1c0a9e6d4b21
status: experimental
description: Detects Gitea repository migration activity followed by abnormal memory growth or process termination, indicative of exploitation of CVE-2026-104633.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104633
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: gitea
detection:
  selection:
    message|contains:
      - 'migrate'
      - 'migration'
  keywords:
    message|contains:
      - 'max_response_items'
      - 'out of memory'
      - 'runtime: out of memory'
  condition: selection or keywords
fields:
  - message
  - remote_ip
  - user
level: high
falsepositives:
  - Legitimate large migrations from trusted instances
  - Normal migration operations

YARA Rule

rule CVE_2026_104633_gitea_migration_dos
{
    meta:
        description = "Detects references to the vulnerable migration pagination parameter associated with CVE-2026-104633 in Gitea artifacts or responses"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104633"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $p1 = "max_response_items" ascii nocase
        $p2 = "max_response_items\":0" ascii
        $p3 = "max_response_items\": 0" ascii

    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104633 Gitea Migration max_response_items Zero DoS Indicator"; flow:established,to_client; http.response_body; content:"max_response_items"; content:"0"; within:40; nocase; classtype:attempted-dos; reference:cve,2026-104633; sid:2026104633; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [ process where event.type == "start" and process.name in ("gitea", "gitea.exe") ]
  [ metrics where system.memory.actual.free_percent < 5 ]

Splunk SPL Query

index=gitea sourcetype=gitea:log
| search "max_response_items" OR "migration" OR "out of memory"
| stats count values(remote_ip) as src_ips by user
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="gitea,web,,">
  <rule id="1046330" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">max_response_items|migration|out of memory</field>
    <description>CVE-2026-104633: Possible Gitea migration-triggered memory exhaustion</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict the repository migration feature to trusted roles; disable or gate migration for low-privileged users if the platform permits.
   • Network-restrict outbound migration fetches (egress allowlisting) so Gitea can only migrate from known, trusted source instances — this blocks the attacker-controlled-source prerequisite.
   • Apply process-level memory limits (systemd MemoryMax, container memory limits) to bound the damage of runaway allocation, and enable the host OOM killer.
   • Monitor migration logs for repeated or anomalous migration attempts and alert on them.

2. Patch / upgrade steps

   • No patch evidence exists in any tracked source. Monitor the Gitea security advisories and release notes for an official fix, and upgrade immediately when an advisory addressing migration pagination is published.
   • Until a fix lands, treat all versions as potentially affected and compensate with the mitigations above.

3. Long-term hardening

   • Validate and clamp remotely supplied numeric configuration values (such as page sizes) to safe bounds before using them as loop boundaries.
   • Adopt defense-in-depth for loop termination: enforce an absolute iteration/time cap independent of remote-supplied values.
   • Reduce the privilege required to invoke resource-intensive features, or require an approval/allowlist for migration sources.
   • Maintain an SBOM and vulnerability-monitoring cadence for self-hosted developer infrastructure.

References

• NVD — CVE-2026-104633: https://nvd.nist.gov/vuln/detail/CVE-2026-104633
• MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CWE-400 Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• Gitea security advisories / release notes (monitor for an official fix)
• FIRST.org EPSS (not yet scored for this CVE)

No CISA KEV listing, public PoC, exploit code, or observed threat-actor campaign was identified for CVE-2026-104633 at the time of writing.