CVEvulnerability
CVE-2026-105964
6.5 MEDIUM
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-10-18
- Last modified
- 2026-10-19
- Assigner
- 88ee5874-cf24-4952-aea0-31affedb7ff2
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-770
Description
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.
Related
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness
References
- https://blog.gitea.com/release-of-28.2.0/ blog.gitea.com
- https://github.com/go-gitea/gitea/pull/39818 github.com
- https://github.com/go-gitea/gitea/pull/39822 github.com
- https://github.com/go-gitea/gitea/releases/tag/v28.2.0 github.com
- https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5ph github.com