CVE-2026-105964

6.5 Moyenne

Publiée le 18/10/2026 à 21:16 · Modifiée le 19/10/2026 à 23:17 · En attente d'analyse NVD · Source : 88ee5874-cf24-4952-aea0-31affedb7ff2

Description

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

Traduire en français

Produits concernés

Gitea

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-770

Références

https://blog.gitea.com/release-of-28.2.0/
https://github.com/go-gitea/gitea/pull/39818
https://github.com/go-gitea/gitea/pull/39822
https://github.com/go-gitea/gitea/releases/tag/v28.2.0
https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5ph

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories