CVE-2026-105964: Gitea Actions artifact v4 API unbounded request body

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-18 · updated 2026-10-19
Weakness: CWE-770

Description

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

Affected products

Gitea Open Source Git Server: from 1.22.0 through 28.1.0

References

https://blog.gitea.com/release-of-28.2.0/
https://github.com/go-gitea/gitea/pull/39818
https://github.com/go-gitea/gitea/pull/39822
https://github.com/go-gitea/gitea/releases/tag/v28.2.0
https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5ph

Get alerted when CVE-2026-105964 or the next vulnerability affects your stack