CVE-2026-55984 Gitea CVE debrief

Who should care

Teams using Gitea should be aware of this vulnerability and take steps to verify the affected scope and apply vendor remediation. Security teams monitoring for denial of service vulnerabilities should also be aware of this vulnerability and take steps to prevent potential exploitation. The CVSS score of 2.7 indicates a low severity, but defenders should still take steps to prevent potential exploitation.

Technical summary

CVE-2026-55984 is a Null Pointer Dereference vulnerability in the AddTime API, which causes an authenticated denial of service. The vulnerability has a CVSS score of 2.7 and a CVSS vector of AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L. The CWE associated with this vulnerability is CWE-284. To defend against this vulnerability, defenders should verify the affected scope and apply vendor remediation. The vulnerability is considered to be of low severity, but defenders should still take steps to prevent potential exploitation.

Defensive priority

Authenticated denial of service vulnerability in AddTime API; LOW CVSS score of 2.7; verify affected scope and apply vendor remediation.

Recommended defensive actions

• Verify affected scope and inventory
• Apply vendor remediation
• Monitor for compensating controls
• Track exceptions
• Review official advisory or CVE record
• Plan vendor-supported updates or mitigations
• Check relevant monitoring, detection, and logs

Evidence notes

The evidence for CVE-2026-55984 is limited to the information provided in the CVE record and NVD detail page. To verify the affected scope and apply vendor remediation, defenders should review the official CVE Program record and NIST NVD detail page. The vulnerability is a Null Pointer Dereference in the AddTime API, which causes an authenticated denial of service. The CVSS score is 2.7, indicating a low severity. However, defenders should still verify the affected scope and apply vendor remediation to prevent potential exploitation. Additionally, defenders should monitor for compensating controls and exception tracking, and retest after vendor remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.