CVE-2026-56657

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description An authenticated user can cause a denial of service by submitting a specially crafted RFC 4716 (SSH2) public key to the SSH key ingestion endpoint. The issue stems from a normalization function that uses an O(N²) string concatenation loop without input size limits. When a key contains a large number of short content lines, the server performs a quadratic amount of work in both time and memory allocations because Go strings are immutable, requiring a new array allocation and copy for every concatenation. This can lead to CPU and memory exhaustion, taking the instance offline.

API Endpoints: '/api/v1/user/keys' Vulnerable Parameters or Variables: key Function Names: parseKeyString(), CheckPublicKeyString(), CreateUserPublicKey()

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.