Memory Exhaustion Issue in Gitea Actions Artifact Handlers

CVE-2026-105964

What is CVE-2026-105964?

Gitea Actions artifact v4 utilizes Twirp handlers that read the full request body into memory without a predefined size limit. This vulnerability permits users with workflow execution capabilities, who can also acquire the runner token of a specific run, to send excessively large requests to the artifact service. Such requests can deplete the server's memory resources, leading to the termination of the Gitea process. As a mitigation measure, the request body size has now been restricted to 1 MiB, preventing potential memory exhaustion attacks.

References