CVE-2026-96580

Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large number of jobs, consuming server memory and potentially terminating the Gitea process. No runner is required. Static matrices above 256 combinations are now rejected before expansion.

• CWE-400

• https://blog.gitea.com/release-of-28.0.0/Release Notes
• https://github.com/go-gitea/gitea/pull/39295Patch
• https://github.com/go-gitea/gitea/releases/tag/v28.0.0Release Notes
• https://github.com/go-gitea/gitea/security/advisories/GHSA-p3rv-cr5f-9gjhVendor Advisory

Published

Oct 6, 2026

Last Modified

Oct 13, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96573The Appointment Hour Booking – Booking Calendar plugin for W…7.2
• CVE-2026-96574The User Frontend – Membership, User Registration, User Prof…6.4
• CVE-2026-96575The Transliterator – Multilingual and Multi-script Text Conv…7.2
• CVE-2026-96577A flaw was found in oc-mirror. During mirroring operations, …7.1
• CVE-2026-96578The GSpeech TTS – WordPress Text To Speech Plugin plugin for…7.2
• CVE-2026-9658Plack::Middleware::Security::Common versions before 0.13.1 f…7.3
• CVE-2026-96581Authorization Bypass Through User-Controlled Key vulnerabili…7.6
• CVE-2026-96582A HID report descriptor is a sequence of items, each declari…4.9
• CVE-2026-96587The Viidure Android application embeds permanent, plaintext …10
• CVE-2026-96589When a private repository is transferred to a user who lacks…4.3
• CVE-2026-9659Multiple exploitable stack-based buffer overflow vulnerabili…9.1
• CVE-2026-96594The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/med…6.1