CVE-2026-105964

UNKNOWN 0.0

Gitea Actions artifact v4 API unbounded request body

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

CWE	CWE-770
Vendor	gitea
Product	gitea
Published	Oct 18, 2026

Stay Ahead of the Next One

Get instant alerts for gitea gitea

Be the first to know when new unknown vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Gitea / Gitea

1.22.0 ≤ 28.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5ph github.com: https://github.com/go-gitea/gitea/pull/39818 github.com: https://github.com/go-gitea/gitea/pull/39822 blog.gitea.com: https://blog.gitea.com/release-of-28.2.0/ github.com: https://github.com/go-gitea/gitea/releases/tag/v28.2.0

Credits

🔍 https://github.com/manus-pi 🔍 https://github.com/N0K0