Skip to content
OpenAdvisories
High · 7.5 CVE-2026-96399 EUVD-2026-93921

Gitea denial of service through external issue tracker patterns

Published Oct 6, 2026 · Updated Oct 7, 2026 · Assigned by Gitea

Description

A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings could make any later rendering of matching content, such as viewing a README, crash the instance for all users.

Affected products

VendorProductAffectedFixed
Gitea Gitea ≤ 1.27.3 —

Advisories 1

References