CVE-2026-105964

Gitea Actions artifact v4 API unbounded request body

6.5 Medium

The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.30%Up 0.1 points since Oct 19, 2026

What each source reports

CVE List Score used 6.5

Gitea Actions artifact v4 API unbounded request body

Record: CVE-2026-105964
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

EUVDEUVD-2026-103985 6.5

Record: EUVD-2026-103985
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

NVD 6.5

Record: CVE-2026-105964
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSV 6.5

Gitea Actions artifact v4 API unbounded request body

Record: CVE-2026-105964
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

Affected products

gitea

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-105964 is a medium vulnerability (CVSS 6.5) in Gitea, published October 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. No source names a fixed version.