Not yet scoredPublished Oct 18, 2026

CVE-2026-105964Gitea Actions artifact v4 API unbounded request body

Updated under an hour ago (2026-10-19 04:00 UTC)

Does this affect you?

It affects Gitea. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Gitea

Exploited in the last 30 days

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

CVSS: Not yet scored
Weakness (CWE): CWE-770
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Gitea
NVD analysis: Received
Record last updated: Oct 18, 2026
First seen by InfoSec Signals: Oct 18, 2026

Affected products

Affected products

Gitea Gitea gitea:gitea (from the name)	from 1.22.0 through 28.1.0	CNA record

References

https://github.com/go-gitea/gitea/security/advisories/GHSA-6f9g-7jgm-m5phvendor-advisory
https://github.com/go-gitea/gitea/pull/39818patch
https://github.com/go-gitea/gitea/pull/39822patch
https://blog.gitea.com/release-of-28.2.0/release-notes
https://github.com/go-gitea/gitea/releases/tag/v28.2.0release-notes

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.