Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Affected: Go: code.gitea.io/gitea

This issue has been found by a security agent and review by myself.

Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to write a pattern that causes the regex engine to backtrack exponentially when evaluated against a crafted file path.

### Who can trigger it

Any registered user on the instance. The attacker needs only: 1. A repository they own (created via normal signup) 2. A `CODEOWNERS` file on the default branch containing malicious patterns 3. A pull request branch containing a file with a crafted name

No elevated permissions, no admin access, no existing repositories required.

### How it is triggered

The attacker pushes a CODEOWNERS file containing repeated instances of a catastrophic backtracking pattern (e.g. (a+)+ @attacker) and opens a pull request from a branch that contains a file named with a long string of repeated characters followed by a non-matching character (e.g. `aaaaaaaaaaaaaaaaaaaaaaaaaaX`). When Gitea processes the pull request, it evaluates each CODEOWNERS rule against each changed file path — with no timeout — causing the server to hang for the duration of the backtracking.

### Impact

Every pull request creation runs this evaluation inside a database transaction. A hung evaluation holds that transaction open, tying up a database connection for the entire duration. With…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.