CVE-2026-95112

Gitea: denial of service

Risk score: 44/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.3%
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of about 1 MB that keeps …
Affected: Gitea
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Gitea: Amber, patch this week. Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pull_request activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow def…

The flaws

CVE-2026-95112: Denial of service (CVSS 6.5 · EPSS 0%)
CVE-2026-94205: Incorrect authorisation (CVSS 9.8 · EPSS 0%)
CVE-2026-60004: Gitea Code Injection Vulnerability (exploited)
CVE-2026-73278: Authentication bypass (CVSS 9.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Gitea

Where it stands

Exploited in the wild
On CISA's exploited list since 25 Aug
US federal deadline 28 Aug

How it unfolded

25 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
28 Aug, Deadline (official): US federal agencies must have patched

Connects to

Same weakness: Denial of service (CWE-407). 70 other warnings in 30 days
Same product: Earlier Gitea warnings. 25 in the last 90 days

Why it is Yellow

CVSS 6.5 medium

References

Original description

When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of about 1 MB that keeps a CPU core busy for several minutes while holding a database transaction open.

Last activity 6 Oct 2026. Patch Forecast updates every hour.