Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-27780

Gitea pre-receive hook can miss branch-protection checks after scanner errors

Description

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Gitea Gitea Open Source Git Server

Default version status: unaffected

  • 0 to < 1.26.0affected

References