CVE-2026-105964

Received Received - Intake

Memory Exhaustion in Gitea Actions Artifact Service

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-105964

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	1.22.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability involves Gitea Actions artifact v4 handlers that read the entire request body into memory without enforcing a size limit. An attacker with workflow execution privileges and access to a runner token can send an excessively large request to the artifact service, consuming all available server memory and causing the Gitea process to terminate.

Impact Analysis

If exploited, this vulnerability could lead to denial-of-service by crashing the Gitea server, disrupting access for all users. It may also allow unauthorized memory consumption, potentially affecting system stability and availability.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. Exhausting server memory may lead to service unavailability, which could violate availability requirements in GDPR Article 32 and HIPAA Security Rule requirements for ensuring access to electronic protected health information.

Mitigation Strategies

Update Gitea to the latest version where the request body limit for artifact handlers is set to 1 MiB to prevent memory exhaustion attacks.

Hi! I’m here to help you understand CVE-2026-105964. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70