CVE-2026-60021
|
| |
|
|
Software afectado |
GITLAB |
|
|
|
Gitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context. An authenticated user who can start migrations can target an attacker-controlled server that keeps the response open indefinitely. The request continues after task cancellation and can exhaust the migration worker pool, preventing other migrations from progressing. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-60021 |
