CVE-2026-105964 Gitea CVE debrief

Who should care

Defenders responsible for Gitea instances should assess their exposure and prioritize verifying and applying the patch to limit the request body size to 1 MiB. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that Gitea instances are updated to a version that includes this fix.

Why it matters

Defenders should prioritize verifying and applying the patch to limit the request body size to 1 MiB and ensuring that Gitea instances are updated to a version that includes this fix.

• Potential denial of service due to memory exhaustion
• Need to verify and apply the patch to prevent exploitation
• Possible impact on Gitea instances that have not been updated

Technical summary

The Gitea Actions artifact v4 API does not limit the size of the request body, allowing an attacker to send an oversized request and exhaust the memory of the server. This issue can be exploited by a user who can run a workflow and obtain the runner token of that run. The vulnerability can lead to potential denial of service due to memory exhaustion. Defenders should prioritize verifying and applying the patch to limit the request body size to 1 MiB and ensuring that Gitea instances are updated to a version that includes this fix.

Defensive priority

Defenders should prioritize verifying and applying the patch to limit the request body size to 1 MiB and ensuring that Gitea instances are updated to a version that includes this fix.

Recommended defensive actions

• Verify and apply the patch to limit the request body size to 1 MiB
• Ensure that Gitea instances are updated to a version that includes this fix
• Monitor Gitea instances for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and the affected versions. However, the CVSS score and severity are not provided. The source item provides additional context about the vulnerability, but its description is limited. The CVE Program record and NVD detail page offer further information on the vulnerability and its potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.