CVE-2026-27780

CRITICAL SEVERITY

CVSS Score & Metrics

Base Score

9.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

Vulnerability Details

Published Date

July 03, 2026

Last Modified

July 06, 2026

CWE ID

CWE-863

Source

NVD

Vendor

Gitea

Product

Gitea Open Source Git Server

External References

https://blog.gitea.com/release-of-1.26.0/
https://github.com/go-gitea/gitea/pull/36963
https://github.com/go-gitea/gitea/releases/tag/v1.26.0

CVE-2026-27780

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment