A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings could make any later rendering of matching content, such as viewing a README, crash the instance for all users.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 06 Oct 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references, causing a runtime panic that terminated the Gitea process. A user who can edit a repository's external issue tracker settings could make any later rendering of matching content, such as viewing a README, crash the instance for all users. | |
| Title | Gitea denial of service through external issue tracker patterns | |
| Weaknesses | CWE-125 CWE-248 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-10-06T19:25:18.075Z
Reserved: 2026-10-04T21:59:53.543Z
Link: CVE-2026-96399
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-06T20:17:35.270
Modified: 2026-10-06T20:17:35.270
Link: CVE-2026-96399
Redhat
No data.
OpenCVE Enrichment
No data.