UNKNOWN NVD
CVE-2026-105964
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runne
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.
References
- https://blog.gitea.com/release-of-28.2.0/
- https://github.com/go-gitea/gitea/pull/39818
- https://github.com/go-gitea/gitea/pull/39822
- https://github.com/go-gitea/gitea/releases/tag/v28.2.0
- https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5ph
This unknown severity vulnerability was published on 2026-10-18 via NVD.
vulnfeed aggregates 17240 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.