{"id":"CVE-2026-105964","kind":"vulnerability","aliases":["CVE-2026-105964"],"related":[],"title":"Gitea: unbounded request body in Actions artifact handlers can crash the server","description":"The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.","summary":"The Gitea Actions artifact v4 (Twirp) handlers read the entire request body into memory with no size limit. A user who can run a workflow and holds that run's runner token can send an oversized request and exhaust server memory, crashing the Gitea process.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","gitea","package","self-hosted"],"not_affected_if":["actions-disabled","managed-hosting"],"how_to_check":"- Check the installed Gitea version with `gitea --version` or the version shown in the admin dashboard.\n- Confirm Gitea Actions is enabled in the app configuration (`[actions] ENABLED = true`).","fix":"- Upgrade Gitea to a release that includes the 1 MiB request body limit for the artifact v4 handlers (exact fixed version: unknown).","status":"open","published_at":"2026-10-18T19:16:32+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:57:29+00:00","updated_at":"2026-10-25T03:57:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:57:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Gitea to a release that includes the 1 MiB request body limit for the artifact v4 handlers (exact fixed version: unknown).","reach":"network","title":"Gitea: unbounded request body in Actions artifact handlers can crash the server","impact":"low","summary":"The Gitea Actions artifact v4 (Twirp) handlers read the entire request body into memory with no size limit. A user who can run a workflow and holds that run's runner token can send an oversized request and exhaust server memory, crashing the Gitea process.","category":"package","nicknames":[],"who_cares":["gitea","self-hosted","ci-cd"],"confidence":0.6,"needs_auth":"yes","worst_case":"Gitea server process crashes from memory exhaustion, causing denial of service.","analyst_note":"Find the fixed Gitea release version and the affected version range in the NVD entry or the Gitea release notes.","how_to_check":"- Check the installed Gitea version with `gitea --version` or the version shown in the admin dashboard.\n- Confirm Gitea Actions is enabled in the app configuration (`[actions] ENABLED = true`).","needs_analyst":true,"not_affected_if":["actions-disabled","managed-hosting"],"who_is_affected":"Self-hosted Gitea instances with Gitea Actions enabled are exposed, since the flaw is in the artifact service that runners call. Instances with Actions disabled, or those that run only on hosted Gitea services managed by someone else, can skip it; the sources do not name the affected version range.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000618,"input_tokens":3326,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105964':15A,18A '-2026':14A,17A '1':133C 'action':6A,29B,74C 'artifact':7A,30B,75C,112C 'bodi':4A,38B,83C,128C 'cd':21B 'ci':20B 'ci-cd':19B 'could':105C 'crash':10A,68B 'cve':13A,16A 'entir':36B 'exhaust':65B,115C 'gitea':1A,22B,28B,70B,73C,124C 'handler':8A,33B,78C 'hold':53B 'host':26B 'limit':44B,89C,131C 'memori':40B,67B,85C,117C 'mib':134C 'obtain':98C 'overs':62B,108C 'packag':23B 'process':71B,125C 'read':34B,79C 'request':3A,37B,63B,82C,109C,127C 'run':49B,55B,94C,104C 'runner':57B,100C 'self':25B 'self-host':24B 'send':60B,106C 'server':12A,66B,120C 'servic':113C 'size':43B,88C 'termin':122C 'token':58B,101C 'twirp':32B,77C 'unbound':2A 'user':46B,91C 'v4':31B,76C 'whole':81C 'without':86C 'workflow':51B,96C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Gitea instances with Gitea Actions enabled are exposed, since the flaw is in the artifact service that runners call. Instances with Actions disabled, or those that run only on hosted Gitea services managed by someone else, can skip it; the sources do not name the affected version range.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T19:16:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105964","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105964","severity":null,"published_at":"2026-10-18T19:16:32+00:00","modified_at":"2026-10-19T21:17:04+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}