CVE-2026-56755

Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Title source: CVE List
STIX 2.1 vulnerability

Description

Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Gitea Open Source Git Server

Browse Gitea / Gitea Open Source Git Server

Default status: unaffected

CVE ListThrough 1.26.4affected

code.gitea.io/gitea

Browse Go / code.gitea.io/gitea
GitHub AdvisoryBefore 1.27.0 · Fixed in 1.27.0affected

References

8