CVE-2026-27780

CriticalCVSS 9.8

Published: 03/07/2026(UTC)Updated: 06/07/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

37th percentile - higher than 37% of all known CVEs

Summary

A vulnerability in Gitea before version 1.26.0 fails to close the connection on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

Risk Assessment

An attacker can bypass branch protection rules, leading to unauthorized changes in the repository, code integrity compromise, and potential injection of malicious code.

Recommendation

Immediately upgrade Gitea to version 1.26.0 or later, which includes a fix that closes the connection on scanner errors.

Original NVD description (English source)

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.