CVE-2026-63914

A flaw was found in the Linux kernel's xfrm and afkey modules. The xfrmsendmigrate and pfkeysendmigrate functions incorrectly hardcode the initnet initial network namespace for migration notifications. This misconfiguration leads to two main issues: migration notifications are delivered to the...

GHSA-5GGR-2F2H-JMVM Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Summary Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if any resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later git clone...

GHSA-H2X6-G7Q6-344V Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

Summary Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if any resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later git clone...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the repository migration. An attacker can access internal network resources by supplying a specially crafted DNS hostname that resolves to both allowed and blocked IP addresses, causing the validation...

GHSA-RQHX-647V-WX32 Gitea: SSRF via HTTP Redirect in Repository Migration

Summary Gitea 1.25.4 validates the initial URL provided to the repository migration endpoint POST /api/v1/repos/migrate and correctly blocks requests to internal addresses like 127.0.0.1 or RFC1918 ranges. However, if the initial URL points to an attacker-controlled server that responds with an...

EUVD-2026-41602

Gitea: SSRF via HTTP Redirect in Repository Migration...

Gitea: SSRF via HTTP Redirect in Repository Migration

Summary Gitea 1.25.4 validates the initial URL provided to the repository migration endpoint POST /api/v1/repos/migrate and correctly blocks requests to internal addresses like 127.0.0.1 or RFC1918 ranges. However, if the initial URL points to an attacker-controlled server that responds with an...

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Summary Gitea's default SSRF allow-list MatchBuiltinExternal, used by both webhook delivery and repository migrations relies on Go's standard library net.IP.IsPrivate, which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal...

EUVD-2026-41618

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter...

GHSA-2R5C-GW76-RH3W Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Summary Gitea's default SSRF allow-list MatchBuiltinExternal, used by both webhook delivery and repository migrations relies on Go's standard library net.IP.IsPrivate, which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal...