CVE-2026-105964

Description

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

References

https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5ph

https://github.com/go-gitea/gitea/releases/tag/v28.2.0

https://github.com/go-gitea/gitea/pull/39822

https://github.com/go-gitea/gitea/pull/39818

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103985

https://blog.gitea.com/release-of-28.2.0/

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3