Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-96399

Gitea denial of service through external issue tracker patterns

Description

A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings could make any later rendering of matching content, such as viewing a README, crash the instance for all users.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Gitea Gitea

Default version status: unaffected

  • 0 to ≤ 1.27.3affected

References