CVE-2026-27780: Gitea pre-receive hook can miss branch-protection checks after scanner errors

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-03 · updated 2026-10-25
Weakness: CWE-863

Description

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

Affected products

Gitea Open Source Git Server: before 1.26.0 — fixed in 1.26.0

How to fix

Upgrade to a fixed version: Gitea Open Source Git Server 1.26.0. Check the vendor advisory for mitigations.

References

https://blog.gitea.com/release-of-1.26.0/
https://github.com/go-gitea/gitea/pull/36963
https://github.com/go-gitea/gitea/releases/tag/v1.26.0

Get alerted when CVE-2026-27780 or the next vulnerability affects your stack