CVE-2026-26307 affects Gitea Open Source Git Server versions prior to 1.25.5. The issue arises because git grep search operations lack enforced timeouts, enabling attackers or users to initiate expensive searches that consume excessive server resources. This uncontrolled resource consumption can degrade service availability or cause denial of service. The vulnerability is remotely exploitable without authentication and requires no user interaction. The CVSS base score is 7.5, reflecting high impact on availability but no impact on confidentiality or integrity. No vendor advisory or patch information is provided in the input data.

The vulnerability allows unauthenticated remote attackers to perform git grep searches that consume excessive server resources, potentially leading to denial of service by exhausting CPU or memory on the affected Gitea server. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider limiting access to git grep functionality or implementing external resource usage controls to mitigate potential denial of service.