---
id: "CVE-2026-105964"
kind: "vulnerability"
aliases: ["CVE-2026-105964"]
title: "Gitea: unbounded request body in Actions artifact handlers can crash the server"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci-cd", "gitea", "package", "self-hosted"]
not_affected_if: ["actions-disabled", "managed-hosting"]
published_at: "2026-10-18T19:16:32+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:57:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105964", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Gitea: unbounded request body in Actions artifact handlers can crash the server

The Gitea Actions artifact v4 (Twirp) handlers read the entire request body into memory with no size limit. A user who can run a workflow and holds that run's runner token can send an oversized request and exhaust server memory, crashing the Gitea process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Gitea version with `gitea --version` or the version shown in the admin dashboard.
- Confirm Gitea Actions is enabled in the app configuration (`[actions] ENABLED = true`).

## Fix

- Upgrade Gitea to a release that includes the 1 MiB request body limit for the artifact v4 handlers (exact fixed version: unknown).

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105964

## From the sources

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_