CVE-2026-42931

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

6.5 MediumFix available

CVE-2026-42931 is a medium vulnerability (CVSS 6.5) in Gitea Open Source Git Server, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in code.gitea.io/gitea 1.27.0.

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.53%Up 0.2 points since Aug 14, 2026

What each source reports

CVE List Score used 6.5

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Record: CVE-2026-42931
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

EUVDEUVD-2026-58135 6.5

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Record: EUVD-2026-58135
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wwqq-x6w4-frm2 6.5

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Summary

An unbounded io.ReadAll(ctx.Req.Body) call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory (OOM) kill. With concurrent requests, the attack produces a persistent denial of service that survives automatic restarts.

Details

The AddPackageTag function reads the entire HTTP request body into memory using io.ReadAll() with no size validation:

// routers/api/packages/npm/npm.go:332-341
func AddPackageTag(ctx *context.Context) {
    packageName := packageNameFromParams(ctx)

    body, err := io.ReadAll(ctx.Req.Body)  // NO SIZE LIMIT
    if err != nil {
        apiError(ctx, http.StatusInternalServerError, err)
        return
    }
    version := strings.Trim(string(body), "\"")
    // ...
}

This route is registered at routers/api/packages/api.go:433:

r.Group("/-/package/{id}/dist-tags", func() {
    // ...
    r.Group("/{tag}", func() {
        r.Put("", npm.AddPackageTag)    // reqPackageAccess(perm.AccessModeWrite)
        r.Delete("", npm.DeletePackageTag)
    })
})

Why this causes OOM and not just a slow request:

In Go, io.ReadAll() reads into a []byte that grows dynamically. When the incoming data exceeds available memory, the Go runtime attempts to allocate a larger backing array. This allocation fails, triggering an unrecoverable runtime.throw("out of memory") that kills the entire process, not just the goroutine handling the request.

No server-side size limits apply to this endpoint:

Gitea has per-type size limits (e.g., LIMIT_SIZE_NPM) defined in modules/setting/packages.go, but these are only enforced during UploadPackage, not in AddPackageTag. The mustBytes() function defaults all limits to -1 (unlimited) when not explicitly configured:

// modules/setting/packages.go:96-101
func mustBytes(section ConfigSection, key string) int64 {
    const noLimit = "-1"
    value := section.Key(key).MustString(noLimit)  // defaults to "-1"
    if value == noLimit {
        return -1
    }

Even if an admin sets LIMIT_SIZE_NPM, it would not protect this endpoint. AddPackageTag never checks any size limit before calling io.ReadAll().

The Gitea HTTP server has no global request body size limit. The HashedBuffer used for package uploads (which does have a 32MB memory buffer before spilling to disk) is not used for this endpoint. AddPackageTag reads the body directly via io.ReadAll(), bypassing all buffer protections:

// modules/packages/hashed_buffer.go:29-33
const DefaultMemorySize = 32 * 1024 * 1024  // 32MB, which is safe and spills to disk

// but npm.go:336 bypasses this entirely:
body, err := io.ReadAll(ctx.Req.Body)  // reads everything into RAM, no limit

Access requirements:

The route requires reqPackageAccess(perm.AccessModeWrite)
Any user has write access to their own package namespace (services/context/package.go:155-157):
```
if doer.ID == pkgOwner.ID {
    accessMode = perm.AccessModeOwner
}
```
No NPM package needs to exist. The OOM occurs at line 336 before the [package lookup at line…

Record: GHSA-wwqq-x6w4-frm2
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

NVD 6.5

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Record: CVE-2026-42931
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSV 6.5

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Record: CVE-2026-42931
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSVGHSA-wwqq-x6w4-frm2 6.5

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Summary

Details

The AddPackageTag function reads the entire HTTP request body into memory using io.ReadAll() with no size validation:

// routers/api/packages/npm/npm.go:332-341
func AddPackageTag(ctx *context.Context) {
    packageName := packageNameFromParams(ctx)

    body, err := io.ReadAll(ctx.Req.Body)  // NO SIZE LIMIT
    if err != nil {
        apiError(ctx, http.StatusInternalServerError, err)
        return
    }
    version := strings.Trim(string(body), "\"")
    // ...
}

This route is registered at routers/api/packages/api.go:433:

r.Group("/-/package/{id}/dist-tags", func() {
    // ...
    r.Group("/{tag}", func() {
        r.Put("", npm.AddPackageTag)    // reqPackageAccess(perm.AccessModeWrite)
        r.Delete("", npm.DeletePackageTag)
    })
})

Why this causes OOM and not just a slow request:

No server-side size limits apply to this endpoint:

// modules/setting/packages.go:96-101
func mustBytes(section ConfigSection, key string) int64 {
    const noLimit = "-1"
    value := section.Key(key).MustString(noLimit)  // defaults to "-1"
    if value == noLimit {
        return -1
    }

Even if an admin sets LIMIT_SIZE_NPM, it would not protect this endpoint. AddPackageTag never checks any size limit before calling io.ReadAll().

// modules/packages/hashed_buffer.go:29-33
const DefaultMemorySize = 32 * 1024 * 1024  // 32MB, which is safe and spills to disk

// but npm.go:336 bypasses this entirely:
body, err := io.ReadAll(ctx.Req.Body)  // reads everything into RAM, no limit

Access requirements:

The route requires reqPackageAccess(perm.AccessModeWrite)
Any user has write access to their own package namespace (services/context/package.go:155-157):
```
if doer.ID == pkgOwner.ID {
    accessMode = perm.AccessModeOwner
}
```
No NPM package needs to exist. The OOM occurs at line 336 before the [package lookup at line…

Record: GHSA-wwqq-x6w4-frm2
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

Show 4 moreShow less

OSVGO-2026-6082 No score

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint in gitea.dev

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint in gitea.dev

Record: GO-2026-6082
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21551-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: openSUSE-SU-2026:21551-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23216-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: SUSE-SU-2026:23216-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23227-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: SUSE-SU-2026:23227-1
Updated: 2026-11-02

Affected products

gitea open source git server

Affected packages

Affected packages
Package	Affected	Fixed
`code.gitea.io/gitea` Go	before 1.27.0	1.27.0
`gitea.dev` Go	before 1.27.0	1.27.0
`govulncheck-vulndb` SUSE:Linux Enterprise Server 16.0	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1
`govulncheck-vulndb` SUSE:Linux Enterprise Server for SAP applications 16.0	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1
`govulncheck-vulndb` openSUSE:Leap 16.0	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 80 moreShow less

This page doesn't list everything

Left out here: the rest of 5 source descriptions. The JSON record has them.