CVE-2026-96580

The Gitea Actions service is vulnerable to memory exhaustion because it expands a workflow's static strategy.matrix into a full Cartesian product without a size limit during run creation. This occurs before the fork pull request approval gate is applied, allowing a user with permission to open a ...