forgejo

5 results · Feed

• Critical 9.8
  CVE-2026-60004 Exploited Public exploit EPSS 24%

  Gitea: Remote Code Execution via diffpatch Git Hook Installation

  Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

  Gitea Gitea code.gitea.io/gitea gitea.dev Alpine Go
  Aug 26, 2026

  KEV Aug 25, 2026
• Medium 5.3
  CVE-2024-24789

  Mishandling of corrupt central directory record in archive/zip

  The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file…

  Go standard library archive/zip go stdlib Debian Ubuntu Alpine Go
  Jun 5, 2024
• Medium 5.9
  CVE-2024-24788

  Malformed DNS message can cause infinite loop in net

  A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

  Go standard library net go stdlib Ubuntu Alpine Go
  May 8, 2024
• High 7.5
  CVE-2023-45288 Public exploit EPSS 89%

  HTTP/2 CONTINUATION flood in net/http

  An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a reques…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Alpine Go
  Apr 4, 2024
• Medium 5.9
  CVE-2023-48795 Public exploit EPSS 94%

  Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

  The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

  openssh lxd erlang openssh Debian Ubuntu Alpine PyPI Go crates.io
  Dec 18, 2023