CVE-2026-101029 Gitea migration and pull mirror SSRF through multi-answer DNS

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct th...

CVE-2026-58442

The Gitea software is vulnerable to a Server-Side Request Forgery (SSRF) during repository migration. This issue stems from a multi-answer DNS allow-list bypass specifically identified in the gitea.dev component. The vulnerability allows an attacker to bypass security restrictions to perform SSRF...

CVE-2026-58442: Exposure of Sensitive Information to an Unauthorized Actor

Repository migration SSRF via multi-answer DNS allow-list bypass...