CVE-2026-26307

Gitea git grep search lacks a timeout

EPSS 0.2%CWE-400

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

03 Jul 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.

Affected products

References