CVE-2026-96580

Summary

Gitea's workflow engine was vulnerable to a denial-of-service attack where a malicious user could create a pull request with a matrix strategy that expands into a huge number of jobs, consuming server memory and potentially crashing the process. This vulnerability affects the workflow processing logic before pull request approval gates are applied.

Exploitability

Exploitation is relatively straightforward for any user who can open a pull request from a fork, requiring only a specially crafted workflow file with an oversized matrix that triggers the Cartesian expansion without needing any runners or additional setup.

Blast radius

The impact could be significant across all Gitea instances running vulnerable versions, as any user with fork access could potentially crash the server process and disrupt service availability for other users.

Detection

Monitor for unusual memory consumption patterns in Gitea processes during workflow processing, particularly when pull requests are opened from forks, and look for process termination or restart events in system logs.

Prioritized remediation

Upgrade to Gitea version 2.590 or later to receive the fix that limits static matrix expansion to prevent excessive memory consumption.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.