CVE-2026-105964None▾ SunlitThe Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.
gitea.dev >= 1.22.0 <= 28.1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-97204NoneGitea label deletion across repository and organization IDs
CVE-2026-109553NoneGitea SSH certificate principal impersonation of other users
CVE-2026-107618NoneGitea cross-site request forgery on repository topics
CVE-2026-105661NoneGitea panic on the repositories route of individual users
CVE-2026-110324NoneGitea private profile information disclosure through POST request
CVE-2026-104627NoneGitea OpenID account linking without session binding