---
id: CVE-2026-105964
title: Gitea Actions artifact v4 API unbounded request body
summary: >-
  The Gitea Actions artifact v4 (Twirp) handlers read the whole request body
  into memory without a size limit. A user who can run a workflow and obtains
  the runner token of that run could send an oversized request to the artifact
  service a…
severity: none
cwe:
  - CWE-770
vendor: Gitea
product: gitea.dev
affected:
  - gitea.dev >= 1.22.0 <= 28.1.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T18:56:47.881Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105964'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5ph'
    label: GitHub Security Advisory GHSA-6f9g-7jgm-m5ph
  - url: 'https://github.com/go-gitea/gitea/pull/39818'
    label: 'Fix: go-gitea/gitea pull request #39818'
  - url: 'https://github.com/go-gitea/gitea/pull/39822'
    label: 'Fix backport to release/v28: go-gitea/gitea pull request #39822'
  - url: 'https://blog.gitea.com/release-of-28.2.0/'
    label: Gitea 28.2.0 release announcement
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v28.2.0'
    label: go-gitea/gitea v28.2.0 release
tags:
  - cve.org
ingestedAt: '2026-10-18T19:51:12.328Z'
---

## Overview

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

## Affected

- `gitea.dev >= 1.22.0 <= 28.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.