CVE-2026-60018

Executive Summary

CVE-2026-60018 is an uncontrolled resource consumption vulnerability (CWE-400) in Gitea's OneDev migration downloader, which reads the entire remote version response into memory without enforcing a size limit and uses an HTTP client configured without a timeout. An authenticated user with permission to initiate a repository migration can point the downloader at an attacker-controlled OneDev-compatible server that returns an oversized or never-ending response, exhausting server memory and tying up migration worker processes. The result is degraded or denied service availability for the affected Gitea instance.

Technical Analysis

The flaw lives in the migration subsystem that supports importing repositories from OneDev. When a migration is started, Gitea performs an outbound HTTP request to the remote OneDev-compatible server to retrieve version information. Two implementation weaknesses combine to create the exposure:

1. Unbounded response buffering. The downloader reads the complete remote version response into memory without applying a maximum size constraint. Because no ceiling is enforced on the number of bytes accepted, a malicious or compromised remote endpoint can stream an arbitrarily large body, causing memory allocation to grow in proportion to the attacker-supplied payload.

2. Absent client timeout. The HTTP client used for this request is instantiated without a timeout. A remote server that accepts the connection but never finishes — or never sends — the response will hold the connection and the corresponding migration worker indefinitely. There is no deadline at which the operation aborts on its own.

The attack surface is the migration initiation workflow: a request path reachable by any authenticated user who is authorized to start a repository migration. The attacker does not need to control the Gitea instance; they only need to control (or spoof DNS/host resolution for) the OneDev-compatible server that the migration targets. The CVSS 3.1 vector reflects this precisely — network vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), scope unchanged (S:U), no confidentiality or integrity impact (C:N/I:N), and high availability impact (A:H), for a base score of 6.5.

The vulnerability is a classic resource-exhaustion pattern: combine an untrusted, attacker-influenced remote endpoint with (a) no read cap and (b) no timeout, and the server's own memory and worker pool become the weapon against it. No code execution, data disclosure, or data tampering is implied by the description; the impact is confined to availability. Note that the NVD description does not enumerate the specific function, class, HTTP handler, or API endpoint involved, so the analysis above is necessarily confined to the vulnerability class and the behavior described, not to named implementation artifacts.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description. No public proof-of-concept, exploit code, or Nuclei template exists for this CVE at the time of writing.

1. Reconnaissance / target identification. The attacker identifies a Gitea instance exposing the migration feature and determines whether OneDev-source migrations are permitted. The attacker also obtains or registers a normal, low-privileged account, since the migration workflow requires authentication and authorization to start a migration.

2. Attacker infrastructure setup. The attacker stands up (or compromises) a server that emulates an OneDev-compatible API well enough to satisfy the migration handshake, in particular the version metadata request that the downloader issues first. Because the flaw is in how the response body is consumed — not in parsing correctness — a minimal compatible responder is sufficient.

3. Triggering the resource-exhaustion condition. The attacker initiates a repository migration from the Gitea UI or API, specifying the attacker-controlled host as the source. When Gitea's downloader requests the remote version, the malicious server responds with one of two hostile behaviors:

   • Oversized response: stream an effectively unbounded body so the downloader buffers it entirely in memory.
   • Never-ending response: accept the connection and send data slowly or not at all, so the timeout-less HTTP client waits forever. Either path consumes memory and holds the worker thread that is executing the migration.

4. Amplification. Because migration workers are a finite resource, an authenticated attacker can repeat migration initiations against the malicious endpoint to occupy multiple workers and multiply memory pressure, converting a single request into a broader availability event.

5. Post-exploitation impact. The outcome is resource exhaustion: elevated memory usage, stalling or starvation of the migration worker pool, and degradation or denial of service for legitimate users of the Gitea instance. There is no described path to code execution, credential theft, or data modification from this flaw alone.

Impact Assessment

The impact is availability-focused and scored as high on that axis (A:H) while confidentiality and integrity are unaffected (C:N/I:N). With a base score of 6.5 (Medium), the flaw requires an authenticated, low-privileged actor and low attack complexity, and it needs no user interaction. The blast radius is the hosting Gitea instance: resource exhaustion on the application server can degrade responsiveness for all users and can hold migration workers that other legitimate migrations depend on. In multi-tenant or shared hosting arrangements, an outage affects every tenant on the instance. Organizations that expose Gitea to broad user bases — including those that allow self-registration — carry elevated risk because the prerequisite is simply the ability to start a migration. Because the memory growth is driven by an external, attacker-controlled stream, a single sustained attack can scale until the process is constrained by container limits, host memory, or an out-of-memory kill, depending on deployment configuration. Containers with memory limits will terminate the Gitea process on limit breach, which converts the resource-exhaustion condition into a harder outage.

Detection Guidance

Sigma Rule

title: Gitea OneDev Migration Resource Exhaustion Attempt
id: 8f1c2a44-5d2b-4b0e-9a77-cve202660018
status: experimental
description: Detects Gitea migration activity targeting OneDev sources that may indicate CVE-2026-60018 resource-exhaustion attempts (oversized or stalled remote version responses holding migration workers).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-60018
author: valtersit.com
date: 2026/01/01
logsource:
  product: gitea
  service: migration
detection:
  selection_event:
    event.action|contains:
      - 'migration'
      - 'migrate'
  selection_source:
    migration.source|contains: 'onedev'
  condition: selection_event and selection_source
falsepositives:
  - Legitimate OneDev migrations from trusted internal sources
level: medium
tags:
  - attack.t1499
  - cwe.400

YARA Rule

rule CVE_2026_60018_Gitea_OneDev_Migration_DoS
{
    meta:
        description = "Detects indicators of Gitea OneDev migration downloader resource-exhaustion activity (CVE-2026-60018) in logs or captured artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-60018"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $onedev = "onedev" nocase
        $migrate = "migration" nocase
        $vtag1 = "version" nocase
        $vtag2 = "api" nocase

    condition:
        $onedev and $migrate and any of ($vtag*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-60018 Gitea OneDev Migration Resource Exhaustion Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"migrate"; nocase; http.request_body; content:"onedev"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-60018; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-60018; sid:202660018; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where network.protocol == "http" and http.request.method == "POST" and
    url.path wildcard "*migrate*" and process.name == "gitea" ]
  [ network where network.protocol == "http" and destination.bytes > 50000000 and
    process.name == "gitea" ]

Splunk SPL Query

index=gitea OR index=web
| search ("migrate" OR "migration") AND ("onedev")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as src_ips values(user) as users by host
| where count > 3
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| table host users src_ips count first_seen last_seen
| sort - count

Wazuh OSSEC Rule

<group name="gitea,web,attack,">
  <rule id="2026601" level="8">
    <decoded_as>json</decoded_as>
    <field name="event.action">\.*(migrat).*</field>
    <field name="migration.source">\.*onedev.*</field>
    <description>CVE-2026-60018: Gitea OneDev migration activity - possible resource exhaustion attempt</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_60018,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict who may initiate repository migrations — grant migration permissions only to trusted administrators, and disable self-registration if it is not required, since the prerequisite is any authenticated user who can start a migration. Where feasible, disable or block the OneDev migration source type entirely until a fix is available. Apply an outbound network egress policy that prevents the Gitea server from reaching arbitrary internet hosts, allowing only explicitly trusted migration sources; this blunts the attacker-controlled endpoint requirement. Enforce memory limits at the container/orchestrator level so a runaway allocation is contained rather than impacting the host, and monitor migration worker occupancy so stuck workers are detected and cleared promptly. Consider fronting migration traffic with a proxy that enforces response-size caps and timeouts on server-initiated outbound requests.

2. Patch / upgrade steps. No vendor fix, patched version, or workaround is identified by tracked sources as of this writing. Monitor the Gitea security advisories and release notes for a fix that adds a response-size limit and an HTTP client timeout to the OneDev migration downloader. When a patched release is published, upgrade immediately and verify the migration subsystem behavior in your environment. Because Patch Confidence is 0/4, do not assume any existing version contains the fix.

3. Long-term hardening. Treat all migration source endpoints as untrusted input. Enforce response-size ceilings and connect/read timeouts on every outbound HTTP client in application code. Run Gitea with least-privilege network egress, resource quotas, and worker-pool limits that fail safely. Add monitoring for abnormal outbound transfer volumes and long-lived migration worker threads, and periodically review permission grants for migration functionality.

References

• NVD — CVE-2026-60018: https://nvd.nist.gov/vuln/detail/CVE-2026-60018
• CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Gitea security advisories and release notes (monitor for a fix addressing the OneDev migration downloader): https://github.com/go-gitea/gitea/security/advisories
• FIRST EPSS: Not yet scored — see https://www.first.org/epss/ for updates

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-60018 at this time. No public PoC, exploit code, or Nuclei template exists; the attack chain above is inferred from the vulnerability class and the NVD description. CVE-2026-60018 is not listed in CISA KEV.