Inefficient Algorithmic Complexity in Gitea - CVE-2026-56657
Published: July 14, 2026
Vulnerability identifier: #VU137435
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-56657
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled algorithmic complexity in the SSH key parser when processing RFC 4716 (SSH2) public keys submitted to the user SSH key ingestion endpoint. A remote user can send a specially crafted key submission to cause a denial of service.
The issue can be triggered through a POST request to /api/v1/user/keys with a Bearer token, and the key is normalized before its validity is checked.
Affected software
Gitea
How to mitigate CVE-2026-56657
Install security update from vendor's website.
Gitea - update to 1.27.0