CVE-2026-105964: falha de média gravidade em Gitea
Gitea Actions artifact v4 API unbounded request body
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.3%
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Gitea · GiteaCVEs relacionadas — Gitea
No mesmo produto, das mais perigosas para as menos.
CVE-2026-60004CRITICALCVE-2026-60004EPSS 24.0%KEVCVE-2026-59774CRITICALGitea Org-mode file disclosure and code executionEPSS 28.3%CVE-2019-1010314—CVE-2019-1010314EPSS 0.8%CVE-2019-1010261—CVE-2019-1010261EPSS 0.8%CVE-2026-94205CRITICALGitea fork workflow approval bypass through maintainer-triggered eventsEPSS 0.6%CVE-2026-96404HIGHGitea installer authentication bypass for existing accountsEPSS 0.6%