https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:49:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352292 EUVD-2026-352292 https://cve.radiocsirt.org/vuln/euvd-2026-352292 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56657 <p>Gitea SSH Key Parser Denial of Service</p> <p>Gitea SSH Key Parser Denial of Service</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-56657 https://cve.radiocsirt.org/vuln/ghsa-4xjf-493q-98p3 <p><strong>Affected:</strong> Go: code.gitea.io/gitea, Go: gitea.dev</p> <p>Gitea&#39;s SSH key ingestion endpoint accepts keys in RFC 4716 (SSH2) format and normalises them before storage. The normalisation function contains an O(N²) string concatenation loop with no input size limit, meaning a single malicious key submission can force the server to perform an amount of work that grows quadratically with the size of the input. Any authenticated user can exploit this to exhaust the server&#39;s CPU and memory, taking the instance offline.</p> <p>### Root Cause</p> <p>An attacker sends a POST /api/v1/user/keys request with a Bearer token and a JSON body whose key field contains a malicious RFC 4716 (SSH2) public key. The key consists of a valid SSH2 header followed by a very large number of short content lines — for example, 400,000 lines of 100 characters each (~38 MB total).</p> <p>The request reaches `CreateUserPublicKey` with no prior size check:</p> <p>https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/routers/api/v1/user/key.go#L201-L212</p> <p>This calls `CheckPublicKeyString` which immediately calls `parseKeyString`. Inside `parseKeyString`, the SSH2 branch splits the input on newlines and accumulates the key body one line at a time using `keyContent += line`:</p> <p>https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/models/asymkey/ssh_key_parse.go#L60-L79</p> <p>Because Go strings are immutable, each `+=` at line 77 allocates a new backing array and copies the entire accumulated string into it. For N lines the total bytes copied is `…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea, Go: gitea.dev</p> <p>Gitea&#39;s SSH key ingestion endpoint accepts keys in RFC 4716 (SSH2) format and normalises them before storage. The normalisation function contains an O(N²) string concatenation loop with no input size limit, meaning a single malicious key submission can force the server to perform an amount of work that grows quadratically with the size of the input. Any authenticated user can exploit this to exhaust the server&#39;s CPU and memory, taking the instance offline.</p> <p>### Root Cause</p> <p>An attacker sends a POST /api/v1/user/keys request with a Bearer token and a JSON body whose key field contains a malicious RFC 4716 (SSH2) public key. The key consists of a valid SSH2 header followed by a very large number of short content lines — for example, 400,000 lines of 100 characters each (~38 MB total).</p> <p>The request reaches `CreateUserPublicKey` with no prior size check:</p> <p>https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/routers/api/v1/user/key.go#L201-L212</p> <p>This calls `CheckPublicKeyString` which immediately calls `parseKeyString`. Inside `parseKeyString`, the SSH2 branch splits the input on newlines and accumulates the key body one line at a time using `keyContent += line`:</p> <p>https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/models/asymkey/ssh_key_parse.go#L60-L79</p> <p>Because Go strings are immutable, each `+=` at line 77 allocates a new backing array and copies the entire accumulated string into it. For N lines the total bytes copied is `…</p> https://cve.radiocsirt.org/vuln/ghsa-4xjf-493q-98p3 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304