Security: go-gitea/gitea
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Unbounded Alpine .PKGINFO parse amplifies a small .apk upload into process memoryGHSA-36q5-5423-vgx2 published
Aug 29, 2026 by bircniModerate -
Authenticated DoS in GitLab migration via uncancelable version probeGHSA-5952-x23q-p23f published
Aug 29, 2026 by bircniModerate -
Authenticated DoS in OneDev migration via unbounded version response bodyGHSA-46px-6cqx-c5fv published
Aug 29, 2026 by bircniModerate -
Repo-side team-link endpoint still bypasses RepoAdminChangeTeamAccessGHSA-g5jj-gp8w-73h7 published
Aug 29, 2026 by bircniHigh -
Remote Code Execution via unescaped markup `Context` into external renderer argvGHSA-579w-82gf-89m2 published
Aug 14, 2026 by bircniHigh -
Admin repository collaborator can self-escalate to Owner and transfer the repositoryGHSA-h62v-wmrr-5qjq published
Aug 14, 2026 by bircniModerate -
Jupyter notebook renderer emits attacker-controlled CSS classes into unsanitized, unsandboxed outputGHSA-7452-653r-6gp8 published
Aug 14, 2026 by bircniModerate -
Package size quota bypass and unbounded memory read in the Maven checksum upload pathGHSA-5xcq-p92v-43rf published
Aug 29, 2026 by bircniModerate -
Repository listing exposes repositories owned by hidden users due to inconsistent visibility predicateGHSA-hch4-r2j8-xm72 published
Aug 29, 2026 by bircniModerate -
Unbounded gitignores repository-creation field enables linear template-read amplificationGHSA-8r3w-5682-jrqf published
Aug 29, 2026 by bircniModerate