[ CVE-2026-105964 · Published 18 Oct 2026 ]
Vulnerability in Gitea
CVSS 6.5
EPSS <1%No fix listed yet
[ Description ]Official description
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.