https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:38:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352915 EUVD-2026-352915 https://cve.radiocsirt.org/vuln/euvd-2026-352915 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58442 <p>Repository migration SSRF via multi-answer DNS allow-list bypass</p> <p>Repository migration SSRF via multi-answer DNS allow-list bypass</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58442 https://cve.radiocsirt.org/vuln/ghsa-h2x6-g7q6-344v <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary</p> <p>Gitea&#39;s repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if **any** resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later `git clone` operation resolves the hostname again outside of that validation decision, so it can connect to the internal address.</p> <p>An authenticated low-privilege user who can create repository migrations can use an attacker-controlled DNS name to make Gitea connect to internal-only Git services and import their contents into a repository controlled by the attacker.</p> <p>### Details</p> <p>The issue is in `services/migrations/migrate.go`, in the migration allow/block-list check.</p> <p>Current logic computes whether any resolved IP is allowed:</p> <p>```go var ipAllowed bool var ipBlocked bool for _, addr := range addrList { ipAllowed = ipAllowed || allowList.MatchIPAddr(addr) ipBlocked = ipBlocked || blockList.MatchIPAddr(addr) } ```</p> <p>Then, when an allow-list is active, the host is accepted if the hostname matches or `ipAllowed` is true:</p> <p>```go if !allowList.IsEmpty() { if !allowList.MatchHostName(hostName) &amp;&amp; !ipAllowed { return &amp;git.ErrInvalidCloneAddr{Host: hostName, IsPermissionDenied: true} } } ```</p> <p>This means a hostname resolving to both:</p> <p>- an allowed public IP, e.g. `1.2.3.4` - a blocked internal IP, e.g. `127.0.0.1`</p> <p>passes validation because the public IP sets `ipAllowed =…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary</p> <p>Gitea&#39;s repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if **any** resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later `git clone` operation resolves the hostname again outside of that validation decision, so it can connect to the internal address.</p> <p>An authenticated low-privilege user who can create repository migrations can use an attacker-controlled DNS name to make Gitea connect to internal-only Git services and import their contents into a repository controlled by the attacker.</p> <p>### Details</p> <p>The issue is in `services/migrations/migrate.go`, in the migration allow/block-list check.</p> <p>Current logic computes whether any resolved IP is allowed:</p> <p>```go var ipAllowed bool var ipBlocked bool for _, addr := range addrList { ipAllowed = ipAllowed || allowList.MatchIPAddr(addr) ipBlocked = ipBlocked || blockList.MatchIPAddr(addr) } ```</p> <p>Then, when an allow-list is active, the host is accepted if the hostname matches or `ipAllowed` is true:</p> <p>```go if !allowList.IsEmpty() { if !allowList.MatchHostName(hostName) &amp;&amp; !ipAllowed { return &amp;git.ErrInvalidCloneAddr{Host: hostName, IsPermissionDenied: true} } } ```</p> <p>This means a hostname resolving to both:</p> <p>- an allowed public IP, e.g. `1.2.3.4` - a blocked internal IP, e.g. `127.0.0.1`</p> <p>passes validation because the public IP sets `ipAllowed =…</p> https://cve.radiocsirt.org/vuln/ghsa-h2x6-g7q6-344v https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304