Executive brief
Gitea, a popular self-hosted Git service, is vulnerable to a denial-of-service attack that can be triggered by unauthenticated users. By sending a specially crafted web request with a malicious language header, an attacker can force the server to consume excessive CPU resources. This can lead to significant performance degradation or a complete service outage for all users.
Technical details
The Gitea Locale middleware calls golang.org/x/text/language.ParseAcceptLanguage on raw Accept-Language headers without prior validation. While the underlying Go library contains a guard against quadratic-time complexity (CVE-2022-32149) by limiting '-' characters, it fails to account for '_' characters which are aliased to '-' during parsing. An unauthenticated attacker can send a 1 MiB header containing many '_' separators to bypass the guard and trigger O(N²) behavior in the parser's scanner. This allows a small number of concurrent requests to saturate server CPU. The vulnerability is fixed in Gitea version 1.27.0 by implementing a limit on the number of separators allowed in the header.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: advisory: Initial GitHub Advisory published
- 2026-07-21: disclosed: Full advisory details released
- 2026-07-21: patched: Vulnerability addressed in version 1.27.0