CVE-2026-55984
Received Received - Intake

Null Pointer Dereference in AddTime API Causes DoS

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-55984
EUVD
EUVD-2026-58139

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
go-gitea gitea to 1.26.4|start_including=1.27.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55984 is a null pointer dereference vulnerability in Gitea's AddTime API. It occurs when a repository administrator tries to add time tracking for a non-existent user. The API fails to handle the error properly, leading to a nil user pointer being accessed, which causes a runtime panic and crashes the server.

Detection Guidance

Check Gitea server logs for repeated crashes or panics during AddTime API calls. Monitor for repository admin actions targeting non-existent users. Verify Gitea version is below 1.27.0.

Impact Analysis

Authenticated users with repository admin privileges can exploit this to repeatedly crash the Gitea server, disrupting service availability. This could lead to downtime, loss of access to repositories, and potential data unavailability during outages.

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later. Ensure repository admins avoid adding time tracking for non-existent users. Apply the suggested fix by adding a return statement after error responses in the AddTime API handler.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55984. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart