CVE-2026-105964CWE-770denial-of-service

CVE-2026-105964

Medium · published October 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-10-18T23:16Z
References (5)
https://blog.gitea.com/release-of-28.2.0/ · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/pull/39818 · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/pull/39822 · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/releases/tag/v28.2.0 · 88ee5874-cf24-4952-aea0-31affedb7ff2https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5ph · 88ee5874-cf24-4952-aea0-31affedb7ff2
EPSS history
Timeline
  • 20 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 18 OCT 18:56Z
    Gitea Actions artifact v4 API unbounded request body
    cvelistv5
  • 18 OCT 18:56Z
    Gitea Actions artifact v4 API unbounded request body
    cvelistv5