The vulnerability in Gitea's CODEOWNERS feature arises from the use of the regexp2 library to match file paths against ownership rules without sanitization or match timeouts. User-controlled regex patterns are compiled and matched against file paths during pull request creation inside a database transaction. Malicious patterns such as '(a+)+' cause catastrophic backtracking when matched against crafted file names, leading to prolonged processing times (e.g., ~30 seconds for 11 rules). This behavior can exhaust database connections when multiple pull requests are created in parallel, resulting in denial of service. The issue affects versions prior to 1.26.4 and requires only a registered user with a repository to exploit.

The vulnerability allows an attacker to cause denial of service by exhausting database connection pools through long-running regex evaluations during pull request creation. This can make the entire Gitea instance unresponsive to all users. There is no impact on confidentiality or integrity, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the ability of users to create or modify CODEOWNERS files with complex regex patterns or implement rate limiting on pull request creation to mitigate potential abuse. Monitor for updates from Gitea regarding an official fix.