CVE-2026-96580— Gitea Actions memory exhaustion through large static matrices
Quick assessment
Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在创建运行实例时，Gitea 将工作流（workflow）的静态 展开为其完整的笛卡尔积，且未设置大小限制，而此过程发生在分支拉取请求（fork pull request）审批门控机制之前。能够以分支方式提交拉取请求的用户，可以提交一个矩阵配置极小的工作流文件，该文件在展开后会生成大量作业（jobs），从而消耗服务器内存，甚至可能导致 Gitea 进程终止。此漏洞无需任何 Runner 即可触发。现在，系统会在展开前拒绝包含超过 256 种组合的静态矩阵。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96580
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea Actions memory exhaustion through large static matrices
Source: CVE Program / CVE List V5
Vulnerability Description
Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large number of jobs, consuming server memory and potentially terminating the Gitea process. No runner is required. Static matrices above 256 combinations are now rejected before expansion.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-96580
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96580
请登录查看更多情报信息。
Other References for CVE-2026-96580 (4)
-
https://github.com/go-gitea/gitea/releases/tag/v28.0.0 release-notes
-
https://blog.gitea.com/release-of-28.0.0/ release-notes
Same Patch Batch · Gitea · 2026-10-06 · 21 CVEs total
| CVE-2026-104636 | Gitea SSRF through Git HTTP redirects in mirrors and fetches | |
| CVE-2026-73278 | Gitea WebAuthn bypass during OAuth and OIDC sign-in | |
| CVE-2026-79960 | Gitea deploy key pushes acting as the repository owner | |
| CVE-2026-70357 | Gitea repository migration SSRF through DNS rebinding | |
| CVE-2026-96589 | Gitea private repository access retained after rejected transfer | |
| CVE-2026-96400 | Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS | |
| CVE-2026-96399 | Gitea denial of service through external issue tracker patterns | |
| CVE-2026-96404 | Gitea installer authentication bypass for existing accounts | |
| CVE-2026-104626 | Gitea fork workflow job revival through later approval | |
| CVE-2026-104632 | Gitea fork workflow approval bypass through cancel and rerun | |
| CVE-2026-94205 | Gitea fork workflow approval bypass through maintainer-triggered events | |
| CVE-2026-101027 | Gitea migration SSRF through ALLOWED_DOMAINS address check bypass | |
| CVE-2026-101029 | Gitea migration and pull mirror SSRF through multi-answer DNS | |
| CVE-2026-95106 | Gitea review and execution mismatch through duplicate tree entries | |
| CVE-2026-95112 | Gitea issue reference parsing CPU exhaustion | |
| CVE-2026-89430 | Gitea push mirror SSRF and forced writes to internal Git hosts | |
| CVE-2026-103504 | Gitea API team demotion not applied to unit permissions | |
| CVE-2026-103667 | Gitea container registry stored XSS through blob media type | |
| CVE-2026-103059 | Gitea built-in SSH server authentication bypass through key case folding | |
| CVE-2026-103670 | Gitea trusted workflow cancellation by unapproved fork runs |
IV. Related Vulnerabilities
Same product: Gitea
-
CVE-2026-73278
Gitea WebAuthn bypass during OAuth and OIDC sign-in -
CVE-2026-96589
Gitea private repository access retained after rejected tran -
CVE-2026-96404
Gitea installer authentication bypass for existing accounts -
CVE-2026-96400
Gitea migration SSRF to reserved addresses through ALLOWED_D -
CVE-2026-96399
Gitea denial of service through external issue tracker patte
Same vendor: Gitea
-
CVE-2026-73278
Gitea WebAuthn bypass during OAuth and OIDC sign-in -
CVE-2026-96589
Gitea private repository access retained after rejected tran -
CVE-2026-96404
Gitea installer authentication bypass for existing accounts -
CVE-2026-96400
Gitea migration SSRF to reserved addresses through ALLOWED_D -
CVE-2026-96399
Gitea denial of service through external issue tracker patte
Same weakness: CWE-400
-
CVE-2026-102404
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-105854
Payload: ReDoS in Multipart Content-Type Validation -
CVE-2026-105760
vLLM: GLMGA video sampling permits request-driven CPU and me -
CVE-2026-105759
vLLM: Unbounded Prometheus label cardinality from attacker-c -
CVE-2026-105749
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS
V. Comments for CVE-2026-96580
No comments yet