Gitea Versions Before 1.26.0: Branch-Protection Bypass Vulnerability
- Severity
- HIGH
- Affected component
- gitea (go)
- Affected versions
- < 1.26.0
- Patched version
- 1.26.0
An early warning has been issued for a vulnerability in Gitea versions before 1.26.0 that may allow branch-protection bypass due to scanner errors. Users of affected versions should assess their exposure and consider upgrading.
What happened
An early warning has been issued regarding a vulnerability in Gitea versions before 1.26.0. This vulnerability, tracked as GHSA-VHQ7-FWWH-7HJF, involves the failure to handle bufio.Scanner errors during pre-receive hook input processing. As a result, oversized input may bypass branch-protection checks. This issue has a high severity rating and is under investigation. It is not yet confirmed to have been exploited in the wild.
The vulnerability affects the gitea (go) component in versions before 1.26.0. The recommended action is to upgrade to Gitea version 1.26.0 or later to mitigate the risk. Users should review their current Gitea version and assess whether they are running an affected version.
What to do about it
- Identify your current Gitea version to determine if it is affected.
- Upgrade to Gitea version 1.26.0 or later to apply the necessary patch.
- Monitor the primary sources for updates on the vulnerability and any additional patches or fixes that may be released.
- Review your branch-protection policies and ensure they are correctly configured post-upgrade.
How 0Day would have caught this
gitea is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Gitea versions before 1.26.0.
What should I do right now?
Identify your current Gitea version and upgrade to version 1.26.0 or later if you are using an affected version.
Is this vulnerability confirmed?
No, this is an early warning and the vulnerability is under investigation.
Has this been exploited in the wild?
No, there is no evidence that this vulnerability has been exploited in the wild.