Vulnerability · Published Oct 18, 2026 · Assigned by Gitea
CVE-2026-105964Gitea Actions artifact v4 API unbounded request body
Medium 6.5
In plain English
A medium-severity resource allocation without limits in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 76.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory GHSA-6f9g-7jgm-m5ph vendor-advisory
- Fix: go-gitea/gitea pull request #39818 patch
- Fix backport to release/v28: go-gitea/gitea pull request #39822 patch
- Gitea 28.2.0 release announcement release-notes
- go-gitea/gitea v28.2.0 release release-notes