CVE-2026-58442

Repository migration SSRF via multi-answer DNS allow-list bypass

6.5 MediumFix available

CVE-2026-58442 is a medium vulnerability (CVSS 6.5) in Gitea Open Source Git Server, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 36th percentile. Fixed in code.gitea.io/gitea 1.27.0.

Repository migration SSRF via multi-answer DNS allow-list bypass

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.43%Up 0.3 points since Aug 14, 2026

What each source reports

CVE List Score used 6.5

Repository migration SSRF via multi-answer DNS allow-list bypass

Repository migration SSRF via multi-answer DNS allow-list bypass

Record: CVE-2026-58442
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-918
Updated: 2026-11-02

EUVDEUVD-2026-58169 6.5

Repository migration SSRF via multi-answer DNS allow-list bypass

Record: EUVD-2026-58169
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-h2x6-g7q6-344v 6.5

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Summary

Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if any resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later git clone operation resolves the hostname again outside of that validation decision, so it can connect to the internal address.

An authenticated low-privilege user who can create repository migrations can use an attacker-controlled DNS name to make Gitea connect to internal-only Git services and import their contents into a repository controlled by the attacker.

Details

The issue is in services/migrations/migrate.go, in the migration allow/block-list check.

Current logic computes whether any resolved IP is allowed:

var ipAllowed bool
var ipBlocked bool
for _, addr := range addrList {
    ipAllowed = ipAllowed || allowList.MatchIPAddr(addr)
    ipBlocked = ipBlocked || blockList.MatchIPAddr(addr)
}

Then, when an allow-list is active, the host is accepted if the hostname matches or ipAllowed is true:

if !allowList.IsEmpty() {
    if !allowList.MatchHostName(hostName) && !ipAllowed {
        return &git.ErrInvalidCloneAddr{Host: hostName, IsPermissionDenied: true}
    }
}

This means a hostname resolving to both:

an allowed public IP, e.g. 1.2.3.4
a blocked internal IP, e.g. 127.0.0.1

passes validation because the public IP sets ipAllowed = true.

The actual repository import is later performed by git clone --mirror via MigrateRepositoryGitData / gitrepo.CloneExternalRepo. That git subprocess performs its own DNS resolution and is not tied to the specific IP set that was validated earlier. If the hostname resolves, rotates, or is re-bound to the internal address at clone time, Gitea can connect to a destination the migration filter would reject if supplied directly.

The direct internal URL is correctly blocked, but the multi-answer hostname is accepted.

PoC

I verified the vulnerable predicate locally against Gitea checkout:

e8654c7e062431a521636703f47339cde64644fd

using Dockerized Go tests with golang:1.26.4.

The local test proves:

checkByAllowBlockList("loopback.example.test", [127.0.0.1]) is rejected.
checkByAllowBlockList("mixed.example.test", [1.2.3.4, 127.0.0.1]) is accepted.

Minimal reproducer at the validation layer:

func TestMigrationMultiAnswerAnyAllowed(t *testing.T) {
    old := setting.Migrations
    t.Cleanup(func() { setting.Migrations = old })

    setting.Migrations.AllowedDomains = ""
    setting.Migrations.BlockedDomains = ""
    setting.Migrations.AllowLocalNetworks = false
    require.NoError(t, Init())

    err := checkByAllowBlockList("mixed.example.test", []net.IP{
        net.ParseIP("1.2.3.4"),
        net.ParseIP("127.0.0.1"),
    })
    require.NoError(t, err, "mixed public+loopback answers should currently pass")

    err = checkByAllowBlockList("loopback.example.test", []net.IP{
        net.ParseIP("127.0.0.1"),
    })
    require.Error(t, err, "loopback-only answer should be rejected")
}

To reproduce end-to-end:

Run Gitea with repository migration enabled and ALLOW_LOCALNETWORKS = false.
Create a normal non-admin user that can create repositories.
Run an internal Git HTTP service reachable only from the Gitea server, for example on 127.0.0.1:18082.
Configure an attacker-controlled hostname so that DNS can return both a public address and 127.0.0.1, or can return a public address during Gitea's pre-flight validation and 127.0.0.1 during the later git clone.
Confirm the direct internal migration is rejected:

curl -X POST http://GITEA/api/v1/repos/migrate \
  -H "Authorization: token USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clone_addr": "http://127.0.0.1:18082/repo.git",
    "repo_name": "direct-internal",
    "service": "git",
    "private": true
  }'…

Record: GHSA-h2x6-g7q6-344v
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-918
Updated: 2026-11-02

NVD 6.5

Repository migration SSRF via multi-answer DNS allow-list bypass

Record: CVE-2026-58442
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-918
Updated: 2026-11-02

OSV 6.5

Repository migration SSRF via multi-answer DNS allow-list bypass

Repository migration SSRF via multi-answer DNS allow-list bypass

Record: CVE-2026-58442
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-918
Updated: 2026-11-02

OSVGHSA-h2x6-g7q6-344v 6.5

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Summary

Details

The issue is in services/migrations/migrate.go, in the migration allow/block-list check.

Current logic computes whether any resolved IP is allowed:

var ipAllowed bool
var ipBlocked bool
for _, addr := range addrList {
    ipAllowed = ipAllowed || allowList.MatchIPAddr(addr)
    ipBlocked = ipBlocked || blockList.MatchIPAddr(addr)
}

Then, when an allow-list is active, the host is accepted if the hostname matches or ipAllowed is true:

if !allowList.IsEmpty() {
    if !allowList.MatchHostName(hostName) && !ipAllowed {
        return &git.ErrInvalidCloneAddr{Host: hostName, IsPermissionDenied: true}
    }
}

This means a hostname resolving to both:

an allowed public IP, e.g. 1.2.3.4
a blocked internal IP, e.g. 127.0.0.1

passes validation because the public IP sets ipAllowed = true.

The direct internal URL is correctly blocked, but the multi-answer hostname is accepted.

PoC

I verified the vulnerable predicate locally against Gitea checkout:

e8654c7e062431a521636703f47339cde64644fd

using Dockerized Go tests with golang:1.26.4.

The local test proves:

checkByAllowBlockList("loopback.example.test", [127.0.0.1]) is rejected.
checkByAllowBlockList("mixed.example.test", [1.2.3.4, 127.0.0.1]) is accepted.

Minimal reproducer at the validation layer:

func TestMigrationMultiAnswerAnyAllowed(t *testing.T) {
    old := setting.Migrations
    t.Cleanup(func() { setting.Migrations = old })

    setting.Migrations.AllowedDomains = ""
    setting.Migrations.BlockedDomains = ""
    setting.Migrations.AllowLocalNetworks = false
    require.NoError(t, Init())

    err := checkByAllowBlockList("mixed.example.test", []net.IP{
        net.ParseIP("1.2.3.4"),
        net.ParseIP("127.0.0.1"),
    })
    require.NoError(t, err, "mixed public+loopback answers should currently pass")

    err = checkByAllowBlockList("loopback.example.test", []net.IP{
        net.ParseIP("127.0.0.1"),
    })
    require.Error(t, err, "loopback-only answer should be rejected")
}

To reproduce end-to-end:

Run Gitea with repository migration enabled and ALLOW_LOCALNETWORKS = false.
Create a normal non-admin user that can create repositories.
Run an internal Git HTTP service reachable only from the Gitea server, for example on 127.0.0.1:18082.
Configure an attacker-controlled hostname so that DNS can return both a public address and 127.0.0.1, or can return a public address during Gitea's pre-flight validation and 127.0.0.1 during the later git clone.
Confirm the direct internal migration is rejected:

curl -X POST http://GITEA/api/v1/repos/migrate \
  -H "Authorization: token USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "clone_addr": "http://127.0.0.1:18082/repo.git",
    "repo_name": "direct-internal",
    "service": "git",
    "private": true
  }'…

Record: GHSA-h2x6-g7q6-344v
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200, CWE-918
Updated: 2026-11-02

Show 4 moreShow less

OSVGO-2026-6058 No score

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev

Record: GO-2026-6058
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21551-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: openSUSE-SU-2026:21551-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23216-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: SUSE-SU-2026:23216-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23227-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: SUSE-SU-2026:23227-1
Updated: 2026-11-02

Affected products

gitea open source git server

Affected packages

Affected packages
Package	Affected	Fixed
`code.gitea.io/gitea` Go	before 1.27.0	1.27.0
`gitea.dev` Go	before 1.27.0	1.27.0
`govulncheck-vulndb` SUSE:Linux Enterprise Server 16.0	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1
`govulncheck-vulndb` SUSE:Linux Enterprise Server for SAP applications 16.0	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1
`govulncheck-vulndb` openSUSE:Leap 16.0	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 80 moreShow less

This page doesn't list everything

Left out here: the rest of 5 source descriptions. The JSON record has them.