CVE-2026-27780

CRITICAL

Gitea pre-receive hook can miss branch-protection checks after scanner errors

Title source: cna
STIX 2.1

Description

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

References (3)

Core 3
Core References
Patch patch
GitHub Pull Request #36963
https://github.com/go-gitea/gitea/pull/36963
Release Notes release-notes
Gitea v1.26.0 Release
https://github.com/go-gitea/gitea/releases/tag/v1.26.0
Release Notes release-notes
Gitea v1.26.0 Release Blog Post
https://blog.gitea.com/release-of-1.26.0/

Scores

CVSS v3 9.8
EPSS 0.0047
EPSS Percentile 38.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-863
Status published
Products (1)
Gitea/Gitea Open Source Git Server < 1.26.0
Published Jul 03, 2026
Tracked Since Jul 04, 2026