MEDIUMCVSS v3.1 6.5Vulnerability
CVE-2026-105964
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-10-20T21:14:08.448323+00:00
- Cvss severity
- MEDIUM
- Cvss score
- 6.5
- Epss score
- 0.00305
- Retrieved at
- 2026-10-21T01:24:48+00:00
- Last source
- FIRST EPSS
- Score
- 6.5
- Cvss version
- 3.1
- Cve id
- CVE-2026-105964
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- First seen by Signal
- 2026-10-18T22:14:59+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Published at
- 2026-10-18T19:16:32.700
- Last modified
- 2026-10-19T21:17:04.323
- Epss percentile
- 0.21893
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph