CVE-2026-105964: Gitea Actions artifact v4 API unbounded request body
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory of the server, which terminates the Gitea process. The request body is now limited to 1 MiB.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be able to run a workflow and obtain the runner token for that specific run. This is therefore most relevant where untrusted or insufficiently trusted users can execute Gitea Actions workflows.
What is the operational impact of a successful attack?
An oversized request to the artifact service can exhaust server memory and terminate the Gitea process, causing denial of service.
What request-size limit addresses the issue?
The corrected behavior limits the artifact v4 API request body to 1 MiB.