Gitea SSH Key Parser Denial of Service

Executive Summary

CVE-2026-56657 is a Denial of Service vulnerability in Gitea's SSH key parser. It involves inefficient string concatenation in the RFC 4716 key normalization function, causing O(N²) resource consumption. Attackers can exploit this by submitting oversized SSH keys to exhaust server CPU and memory.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual CPU or memory spikes during SSH key uploads. Check Gitea logs for failed key parsing attempts or OOM errors. Use system monitoring tools like top, htop, or ps to observe resource consumption during key ingestion.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated users to crash Gitea servers by submitting maliciously large SSH keys. This results in service unavailability, degraded performance, or complete downtime for all users relying on the affected Gitea instance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later to patch the vulnerability. Restrict access to the SSH key ingestion endpoint to trusted users only. Implement rate limiting on key uploads to prevent abuse.

Useful 0 Not Useful 0