Allocation of Resources Without Limits or Throttling in Gitea - CVE-2026-105964
Published: October 19, 2026
Vulnerability identifier: #VU156121
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-105964
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service affecting all Gitea services by exhausting server memory.
The vulnerability exists due to allocation of resources without size limits in the parseProtobufBody function of Gitea's Actions Artifact V4 API when reading HTTP request bodies into memory using io.ReadAll. A remote user can use a valid Actions runner token to send an oversized HTTP POST request to any of the five Artifact Service endpoints, exhausting heap memory and causing fatal termination of the Gitea process.
Exploitation requires push access to a repository with Actions enabled and a connected runner.
Affected software
Gitea
How to mitigate CVE-2026-105964
Install security update from vendor's website.
Gitea - update to 28.2.0