CVE-2026-96580 Gitea CVE debrief

Who should care

Defenders responsible for Gitea instances, especially those exposed to untrusted users, should assess exposure and prioritize upgrading to version 28.0.0 or later. This includes Gitea administrators, security teams, and operators who manage Gitea deployments. They should verify instance exposure, review official advisories, and plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

Defenders should prioritize verifying exposure of Gitea instances to untrusted users and upgrading to version 28.0.0 or later to prevent potential memory exhaustion and process termination.

• Potential memory exhaustion and process termination
• Need to verify exposure of Gitea instances to untrusted users
• Requirement to upgrade to version 28.0.0 or later
• Monitoring server memory usage for unusual patterns

Technical summary

Gitea expanded a workflow's static strategy.matrix into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large number of jobs, consuming server memory and potentially terminating the Gitea process. No runner is required. Static matrices above 256 combinations are now rejected before expansion.

Defensive priority

Defenders should prioritize verifying exposure of Gitea instances to untrusted users and upgrading to version 28.0.0 or later.

Recommended defensive actions

• Verify exposure of Gitea instances to untrusted users
• Upgrade to version 28.0.0 or later
• Monitor server memory usage for unusual patterns
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected version and fixed version. The vulnerability allows a user who can open a pull request from a fork to submit a small workflow file whose matrix expands to a very large number of jobs, consuming server memory and potentially terminating the Gitea process. Evidence is limited to public CVE details and source item information. Defenders should verify Gitea instance exposure to untrusted users and review official advisories for specific version and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.