CVE-2026-105964

Gitea Actions artifact v4 API unbounded request body

State: Published
Severity: 6.5 Medium
Published: Oct 18, 2026
Updated: Oct 19, 2026
Reserved: Oct 14, 2026

Description

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
GiteaGitea	1.22.0 through 28.1.0Affected

References

GitHub Security Advisory GHSA-6f9g-7jgm-m5phvendor-advisory
Fix: go-gitea/gitea pull request #39818patch
Fix backport to release/v28: go-gitea/gitea pull request #39822patch
Gitea 28.2.0 release announcementrelease-notes
go-gitea/gitea v28.2.0 releaserelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.