CVE-2026-95112 Gitea CVE debrief

Who should care

Gitea administrators and defenders should assess exposure and apply patches. Roles include Gitea instance administrators, security teams, and DevOps engineers. These stakeholders should prioritize verifying exposure and applying patches for Gitea instances, especially those with public issue tracking, to prevent potential operational impacts. The vulnerability's impact on affected operators, platforms, and security teams suggests that defenders should take

Why it matters

CVE-2026-95112 is a CPU exhaustion vulnerability in Gitea that can be exploited by an authenticated user submitting crafted issue or comment content. Defenders should prioritize verifying exposure and applying patches for Gitea instances, especially those with public issue tracking.

• CPU exhaustion can lead to denial of service
• Database transactions can be held open for an extended period
• Defenders need to verify exposure and apply patches

Technical summary

Gitea is vulnerable to CPU exhaustion through crafted issue or comment content. An authenticated user can submit a crafted body of about 1 MB to keep a CPU core busy for several minutes while holding a database transaction open. This vulnerability can lead to denial of service and extended database transaction hold times. Defenders should prioritize verifying exposure and applying patches for Gitea instances, especially those with public issue tracking. The vulnerability's technical framing suggests that defenders should focus on verifying exposure and applying patches.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Gitea instances, especially those with public issue tracking.

Recommended defensive actions

• Verify Gitea instance exposure and apply patches
• Monitor issue and comment content for suspicious activity
• Implement rate limiting on issue and comment submissions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and vendor advisory indicate that Gitea is vulnerable to CPU exhaustion through crafted issue or comment content. An authenticated user can exploit this by submitting a crafted body of about 1 MB.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.