Threats tagged 'ghsa-v96j-25gv-g2w9'

Gitea versions prior to 1.26.4 contain a vulnerability in the CODEOWNERS feature where user-supplied regex patterns are compiled without sanitization or timeout, enabling a Regular Expression Denial of Service (ReDoS) attack. An attacker with a repository can craft malicious CODEOWNERS patterns and file names in pull requests that cause exponential regex backtracking, hanging the server during pull request processing. This results in database connections being held open, potentially exhausting the connection pool and making the Gitea instance unresponsive.