CVE-2026-105964

The Gitea Actions artifact v4 Twirp handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gite...

CVE-2026-105964

The Gitea Actions artifact v4 Twirp handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gite...

EUVD-2026-103985

The Gitea Actions artifact v4 Twirp handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gite...

CVE-2026-105964 Gitea Actions artifact v4 API unbounded request body

The Gitea Actions artifact v4 Twirp handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gite...

CVE-2026-105964 Gitea Actions artifact v4 API unbounded request body

The Gitea Actions artifact v4 Twirp handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gite...

CVE-2026-105964

The Gitea Actions artifact v4 (Twirp) handlers are vulnerable to memory exhaustion because they read the entire request body into memory without an enforced size limit. An attacker who can execute a workflow and obtain a runner token can send an oversized request to the artifact service, exhausti...

CVE-2026-105964 Gitea Actions artifact v4 API unbounded request body

The Gitea Actions artifact v4 Twirp handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gite...

PT-2026-117148

The Gitea Actions artifact v4 Twirp handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gite...

CVE-2026-105964: Allocation of Resources Without Limits or Throttling

The Gitea Actions artifact v4 Twirp handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gite...

Gitea resource management error vulnerability

The Gitea versions from 1.22.0 to 28.1.0 have a resource management vulnerability. This vulnerability stems from the Gitea Actions artifact v4 Twirp processor, which does not limit the size of the entire request body when reading it into memory. Users who have permission to run workflows and acce...

Malicious code in monolith-twirp-webhooks-core (RubyGems)

Source: ossf-package-analysis 2ce839cee3a269944cf305057d6746895eb15dec90dbbe6dd48210569287082d The OpenSSF Package Analysis project identified 'monolith-twirp-webhooks-core' @ 1.7.0 rubygems as malicious. It is considered malicious because: - The package executes one or more commands associated...

Malicious code in monolith-twirp-webhooksubscriptions-subscriptions (RubyGems)

Source: ossf-package-analysis df56bfac6f56194f6dc4db74f8761484bd20d2a46e61558f757a3179e3e249e8 The OpenSSF Package Analysis project identified 'monolith-twirp-webhooksubscriptions-subscriptions' @ 1.5.0 rubygems as malicious. It is considered malicious because: - The package executes one or more...

Malicious code in monolith-twirp-trusttiers-trusttier (RubyGems)

Source: ossf-package-analysis 19041d396a96e8d46b2fd05aa6e0b2f4f1e355f01a98bd0e7a3fbc513a6f09a7 The OpenSSF Package Analysis project identified 'monolith-twirp-trusttiers-trusttier' @ 1.0.3 rubygems as malicious. It is considered malicious because: - The package executes one or more commands...

Malicious code in monolith-twirp-support-helphub (RubyGems)

Source: ossf-package-analysis 97a64bd75388afe20d55befa04ed845034b1a467cace9204788c98fd29240024 The OpenSSF Package Analysis project identified 'monolith-twirp-support-helphub' @ 1.48.0 rubygems as malicious. It is considered malicious because: - The package executes one or more commands associate...

Malicious code in monolith-twirp-pullsd-users (RubyGems)

--- Credit: OpenSSF source...

Malicious code in monolith-twirp-proxima-enterprisemanagement (RubyGems)

Source: ossf-package-analysis 2565ee1140267bcec7b5665365d0e0ed3dcebad8035fdbf833423af04aeb7f86 The OpenSSF Package Analysis project identified 'monolith-twirp-proxima-enterprisemanagement' @ 1.2.3 rubygems as malicious. It is considered malicious because: - The package executes one or more comman...

Malicious code in monolith-twirp-octoshift-migrations (RubyGems)

Source: ossf-package-analysis 8c8938887f6cff7780099f00ec00251da4904659f59fb9c197583288fc8951c4 The OpenSSF Package Analysis project identified 'monolith-twirp-octoshift-migrations' @ 1.8.0 rubygems as malicious. It is considered malicious because: - The package executes one or more commands...

Malicious code in monolith-twirp-octoshift-imports (RubyGems)

Source: ossf-package-analysis 221b3fbda6780c082532d35d4b0ce79ea245c161c259ec2d4e3f741df68efe52 The OpenSSF Package Analysis project identified 'monolith-twirp-octoshift-imports' @ 2.7.1 rubygems as malicious. It is considered malicious because: - The package executes one or more commands associat...

Malicious code in monolith-twirp-copilot-registry (RubyGems)

Source: ossf-package-analysis d1eb9592b2f976d7d487d44c8f45592b2953e5f51edfeee7242e020dfb64176f The OpenSSF Package Analysis project identified 'monolith-twirp-copilot-registry' @ 1.0.6 rubygems as malicious. It is considered malicious because: - The package communicates with a domain associated...

Malicious code in monolith-twirp-features-featureflaghub (RubyGems)

Source: ossf-package-analysis 8fb5fd24604e319bf0fd432162579d9b9ffa30c7eb829de263bccf4f7a04d58b The OpenSSF Package Analysis project identified 'monolith-twirp-features-featureflaghub' @ 1.5.0 rubygems as malicious. It is considered malicious because: - The package executes one or more commands...