CVE-2026-105964

EUVD-2026-103985
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GiteaCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 22.01%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
giteagitea
1.22.0 ≤
𝑥
≤ 28.1.0
CNA
Common Weakness Enumeration
References
https://blog.gitea.com/release-of-28.2.0/
https://github.com/go-gitea/gitea/pull/39818
https://github.com/go-gitea/gitea/pull/39822
https://github.com/go-gitea/gitea/releases/tag/v28.2.0
https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5ph