CVE-2026-95112 json
Gitea issue reference parsing CPU exhaustion
published 2026-10-06 33 d ago modified 2026-10-14 25 d ago also BIT-gitea-2026-95112 , EUVD-2026-93920 , GHSA-467c-4w7p-8427
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of about 1 MB that keeps a CPU core busy for several minutes while holding a database transaction open.
Patch / fix
- bitnami gitea 28.0.0
- gitea gitea 28.0.0
- github.com/go-gitea/gitea#39396 pull request
- github.com/go-gitea/gitea/releases/tag/v28.0.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 31 d ago
Exploit prediction
0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | gitea | <28.0.0 |
28.0.0 |
Affected products
- Gitea Gitea
Classification
- Weakness
-
- CWE-407 Inefficient Algorithmic Complexity
References
-
github.com
/go-gitea/gitea/pull/39396
patch
-
github.com
/go-gitea/gitea/security/advisories/GHSA-467c-4w7p-8427
vendor-advisory, advisory
-
blog.gitea.com
/release-of-28.0.0/
release-notes, article
-
github.com
/go-gitea/gitea/releases/tag/v28.0.0
release-notes, article
-
nvd.nist.gov
/vuln/detail/CVE-2026-95112
web
Sources
- CVE List CVE-2026-95112
- NVD CVE-2026-95112
- OSV BIT-gitea-2026-95112
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.