https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 02:34:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-333342 EUVD-2026-333342 https://cve.radiocsirt.org/vuln/euvd-2026-333342 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58421 <p>Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service</p> <p>Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58421 https://cve.radiocsirt.org/vuln/ghsa-v96j-25gv-g2w9 <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>This issue has been found by a security agent and review by myself.</p> <p>Gitea&#39;s CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to write a pattern that causes the regex engine to backtrack exponentially when evaluated against a crafted file path.</p> <p>### Who can trigger it</p> <p>Any registered user on the instance. The attacker needs only: 1. A repository they own (created via normal signup) 2. A `CODEOWNERS` file on the default branch containing malicious patterns 3. A pull request branch containing a file with a crafted name</p> <p>No elevated permissions, no admin access, no existing repositories required.</p> <p>### How it is triggered</p> <p>The attacker pushes a CODEOWNERS file containing repeated instances of a catastrophic backtracking pattern (e.g. (a+)+ @attacker) and opens a pull request from a branch that contains a file named with a long string of repeated characters followed by a non-matching character (e.g. `aaaaaaaaaaaaaaaaaaaaaaaaaaX`). When Gitea processes the pull request, it evaluates each CODEOWNERS rule against each changed file path — with no timeout — causing the server to hang for the duration of the backtracking.</p> <p>### Impact</p> <p>Every pull request creation runs this evaluation inside a database transaction. A hung evaluation holds that transaction open, tying up a database connection for the entire duration. With…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>This issue has been found by a security agent and review by myself.</p> <p>Gitea&#39;s CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to write a pattern that causes the regex engine to backtrack exponentially when evaluated against a crafted file path.</p> <p>### Who can trigger it</p> <p>Any registered user on the instance. The attacker needs only: 1. A repository they own (created via normal signup) 2. A `CODEOWNERS` file on the default branch containing malicious patterns 3. A pull request branch containing a file with a crafted name</p> <p>No elevated permissions, no admin access, no existing repositories required.</p> <p>### How it is triggered</p> <p>The attacker pushes a CODEOWNERS file containing repeated instances of a catastrophic backtracking pattern (e.g. (a+)+ @attacker) and opens a pull request from a branch that contains a file named with a long string of repeated characters followed by a non-matching character (e.g. `aaaaaaaaaaaaaaaaaaaaaaaaaaX`). When Gitea processes the pull request, it evaluates each CODEOWNERS rule against each changed file path — with no timeout — causing the server to hang for the duration of the backtracking.</p> <p>### Impact</p> <p>Every pull request creation runs this evaluation inside a database transaction. A hung evaluation holds that transaction open, tying up a database connection for the entire duration. With…</p> https://cve.radiocsirt.org/vuln/ghsa-v96j-25gv-g2w9 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149