CVE-2026-96399 Gitea CVE debrief

Who should care

Gitea administrators and users with access to repository settings should assess exposure and prioritize updates. Defenders should review the CVE record and source item for details on the vulnerability and consider the potential operational impacts, including denial-of-service for all users of a Gitea instance and the need to verify and update Gitea instances to prevent exploitation.

Why it matters

Defenders should prioritize verifying and updating Gitea instances to prevent exploitation, as an attacker could crash the instance for all users by editing a repository's external issue tracker settings with a malicious regular expression.

• Potential denial-of-service for all users of a Gitea instance
• Need to verify and update Gitea instances to prevent exploitation
• Possible impact on Gitea instance stability and availability

Technical summary

A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings could make any later rendering of matching content, such as viewing a README, crash the instance for all users. This vulnerability affects Gitea instances with user-accessible repository settings. Defenders should prioritize verifying and updating Gitea instances to prevent exploitation.

Defensive priority

Defenders should prioritize verifying and updating Gitea instances to prevent exploitation.

Recommended defensive actions

• Verify Gitea instances for exposure to external issue tracker settings
• Update Gitea to version 28.0.0 or later
• Restrict access to repository settings for untrusted users
• Monitor Gitea instance stability and error logs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on affected versions and remediation. Gitea administrators should verify instances for exposure and prioritize updates. The CVE Program record (CVE-2026-96399) and NVD detail page offer official vulnerability assessments. A patch pull request (#39354) and vendor advisory (GHSA-mw6q-qj47-9g5q) are available for review.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.