CVE-2026-27780: Gitea pre-receive hook scanner errors allow branch-protection bypass
Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.
Published Jul 3, 2026 · Updated Sep 1, 2026
Affected packages
code.gitea.io/gitea
- Ecosystem
- Go
- Affected
- < 1.26.0
- Fixed in
- 1.26.0
- Check
go list -m code.gitea.io/gitea
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-27780
- https://github.com/go-gitea/gitea/pull/36963
- https://blog.gitea.com/release-of-1.26.0
- https://github.com/go-gitea/gitea/releases/tag/v1.26.0
- https://github.com/go-gitea/gitea/commit/c453d09c36fad094405314dba2f370434b200711
- https://github.com/advisories/GHSA-vhq7-fwwh-7hjf
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Go vulnerabilities
All Go entriesCVE-2026-20896
Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
critical9.8Jul 21, 2026CVE-2026-22874
Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
critical9.6Jul 21, 2026CVE-2026-56750
Gitea Remember-Me Token Theft Not Invalidating Attacker Session
critical9.1Jul 21, 2026CVE-2026-58426
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write
critical9.6Jul 21, 2026CVE-2026-58443
Gitea: Public-only repository tokens can update private PR head branches
critical9.6Jul 21, 2026CVE-2026-22547
Gitea repository creation accepts insufficiently validated fields
critical9.1Jul 3, 2026