CVE-2026-58421: CODEOWNERS Pattern Matching DoS Vulnerability

CVE-2026-58421 Overview

CVE-2026-58421 is a Regular Expression Denial of Service (ReDoS) vulnerability in Gitea, an open-source self-hosted Git service. The flaw resides in the pattern matching logic used to process CODEOWNERS files. An unauthenticated attacker can craft input that triggers catastrophic backtracking in the regex engine, exhausting CPU resources on the server. The condition maps to [CWE-284] Improper Access Control and results in service-wide denial of service. Gitea addressed the issue in release v1.26.4.

Critical Impact
Remote unauthenticated attackers can exhaust CPU resources on Gitea servers, rendering the Git hosting service unavailable to legitimate users.

Affected Products

Gitea (self-hosted Git service) versions prior to 1.26.3
Gitea (self-hosted Git service) versions prior to 1.26.4
Deployments using repositories that include CODEOWNERS files

Discovery Timeline

2026-07-03 - CVE-2026-58421 published to NVD
2026-07-06 - Last updated in NVD database
Gitea released fixed versions 1.26.3 and 1.26.4 per the Gitea Release Announcement

Technical Details for CVE-2026-58421

Vulnerability Analysis

The vulnerability affects Gitea's CODEOWNERS pattern matching subsystem. Gitea parses CODEOWNERS files to map repository paths to reviewers. The parsing routine converts path patterns into regular expressions for matching. Certain crafted patterns produce regex constructs vulnerable to catastrophic backtracking. When the regex engine evaluates specific inputs, it enters exponential-time execution paths. This blocks the request thread and consumes CPU cycles. Because the endpoint processing CODEOWNERS content is reachable without authentication in some contexts, attackers do not need valid credentials to trigger the condition. Repeated requests amplify the effect and can render the entire Gitea instance unresponsive. The fix landed in GitHub Pull Request 38011 and shipped in Gitea Release v1.26.4.

Root Cause

The root cause is an inefficient regular expression generated from user-controllable CODEOWNERS patterns. The regex contains overlapping quantifiers that allow the matcher to explore an exponential number of states for adversarial inputs. Gitea did not enforce complexity limits or apply a non-backtracking matcher before evaluating attacker-influenced content.

Attack Vector

An unauthenticated attacker sends network requests that cause Gitea to evaluate the vulnerable CODEOWNERS matcher against crafted input. Each malicious request pins a CPU core for an extended duration. Concurrent requests exhaust available worker threads, denying service to legitimate Git and web traffic.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-v96j-25gv-g2w9 for authoritative technical details.

Detection Methods for CVE-2026-58421

Indicators of Compromise

Sustained high CPU utilization by the gitea process without corresponding legitimate workload
HTTP request logs showing repeated access to endpoints that parse or evaluate CODEOWNERS content
Increased request latency and timeouts on Gitea web and API endpoints
Growing worker thread queue depth or connection saturation on the Gitea reverse proxy

Detection Strategies

Alert on Gitea process CPU consumption exceeding baseline thresholds for more than 60 seconds
Correlate slow HTTP responses with repeated requests from the same source IP against repository endpoints
Monitor for anomalous CODEOWNERS file modifications introducing unusually complex glob patterns
Track HTTP 5xx and gateway timeout error rates from the Gitea front end

Monitoring Recommendations

Collect Gitea application logs and reverse proxy access logs into a centralized log platform for correlation
Instrument the Gitea host with process-level CPU and thread metrics tagged by request path
Establish rate-limit alerts on unauthenticated endpoints that trigger repository pattern evaluation
Review recent commits to CODEOWNERS files for regex patterns with nested quantifiers such as (a+)+

How to Mitigate CVE-2026-58421

Immediate Actions Required

Upgrade Gitea to version 1.26.4 or later as documented in the Gitea Release Announcement
Restrict network exposure of Gitea to trusted networks or place it behind an authenticating reverse proxy where feasible
Enforce rate limiting on unauthenticated request paths at the reverse proxy or WAF layer
Audit repositories for recently added or modified CODEOWNERS files containing complex patterns

Patch Information

Gitea released the fix in Gitea Release v1.26.4. The patch is tracked in GitHub Pull Request 38011. Administrators should apply the upgrade following the standard Gitea update procedure and restart the service to load the corrected pattern-matching code.

Workarounds

Block or throttle requests from source IPs that generate sustained high-CPU responses at the reverse proxy
Temporarily restrict repository creation and CODEOWNERS modification to trusted users until the upgrade is applied
Deploy a WAF rule to reject request bodies containing regex patterns with deeply nested quantifiers
Configure resource limits on the Gitea process using systemdCPUQuota or container CPU limits to contain impact

bash

# Configuration example: constrain Gitea CPU usage with systemd
# /etc/systemd/system/gitea.service.d/override.conf
[Service]
CPUQuota=200%
TasksMax=512

# Reload and restart
sudo systemctl daemon-reload
sudo systemctl restart gitea

# Verify upgraded version
gitea --version