CRITICAL9.8

GHSA-vhq7-fwwh-7hjf

Gitea pre-receive hook scanner errors allow branch-protection bypass

Quick fix

GHSA-vhq7-fwwh-7hjf — code.gitea.io/gitea: upgrade to the fixed version with the command below.

go get code.gitea.io/gitea@v1.26.0

Details

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/code.gitea.io/gitea

Introduced in: 0Fixed in: 1.26.0

Fixgo get code.gitea.io/gitea@v1.26.0

References

https://nvd.nist.gov/vuln/detail/CVE-2026-27780[ADVISORY]
https://github.com/go-gitea/gitea/pull/36963[WEB]
https://github.com/go-gitea/gitea/commit/c453d09c36fad094405314dba2f370434b200711[WEB]
https://blog.gitea.com/release-of-1.26.0[WEB]
https://github.com/go-gitea/gitea[PACKAGE]
https://github.com/go-gitea/gitea/releases/tag/v1.26.0[WEB]