CVE-2026-105964

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The Gitea Actions artifact v4 (Twirp) handlers read the entire request body into memory without a size limit. An attacker who can execute a workflow and obtain the associated runner token can send an oversized request to the artifact service. This action can exhaust the server memory, leading to the termination of the Gitea process. Twirp is a lightweight RPC framework.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.