Executive brief
Gitea is an open-source self-hosted software development platform. A vulnerability in its code ownership matching feature allows any registered user to crash or significantly slow down the service. By uploading a specially crafted file and opening a pull request, an attacker can exhaust the server's database connections, making the platform unavailable to all other users.
Technical details
Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules without proper sanitization or match timeouts. An attacker with repository creation privileges can push a CODEOWNERS file containing patterns prone to catastrophic backtracking (e.g., '(a+)+'). When a pull request is subsequently created with a specifically crafted filename, the regex engine enters an exponential backtracking state. Because this evaluation occurs within a database transaction, it ties up a database connection for the duration of the hang. Multiple concurrent requests can exhaust the database connection pool, leading to a complete denial of service. This is patched in version 1.26.4.
Affected products
- Gitea Gitea <= 1.26.2
Timeline
- 2026-07-01: disclosed
- 2026-07-21: advisory: GHSA-v96j-25gv-g2w9 published
- 2026-07-21: patched: Version 1.26.4 released