{"id":"CVE-2026-96580","published":"2026-10-06T20:17:35.600","lastModified":"2026-10-07T21:17:22.490","description":"Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied. A user who can open a pull request from a fork could submit a small workflow file whose matrix expands to a very large number of jobs, consuming server memory and potentially terminating the Gitea process. No runner is required. Static matrices above 256 combinations are now rejected before expansion.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-400"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39295","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-p3rv-cr5f-9gjh","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/39295","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-p3rv-cr5f-9gjh","tags":[]}],"hasPoc":true,"ai":{"summary":"Gitea's workflow engine was vulnerable to a denial-of-service attack where a malicious user could create a pull request with a matrix strategy that expands into a huge number of jobs, consuming server memory and potentially crashing the process. This vulnerability affects the workflow processing logic before pull request approval gates are applied.","exploitability":"Exploitation is relatively straightforward for any user who can open a pull request from a fork, requiring only a specially crafted workflow file with an oversized matrix that triggers the Cartesian expansion without needing any runners or additional setup.","blast_radius":"The impact could be significant across all Gitea instances running vulnerable versions, as any user with fork access could potentially crash the server process and disrupt service availability for other users.","remediation":"Upgrade to Gitea version 2.590 or later to receive the fix that limits static matrix expansion to prevent excessive memory consumption.","detection":"Monitor for unusual memory consumption patterns in Gitea processes during workflow processing, particularly when pull requests are opened from forks, and look for process termination or restart events in system logs.","tags":["denial-of-service","workflow","git","ci-cd"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:04:21.007Z"}}