GHSA-vhq7-fwwh-7hjf

Gitea pre-receive hook scanner errors allow branch-protection bypass

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-27780

Packages

Ecosystem	Package	Affected	Fixed in
Go	code.gitea.io/gitea	< 1.26.0	1.26.0

Details

As written in the advisory (Markdown source, shown as plain text).

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-27780 advisory
https://github.com/go-gitea/gitea/pull/36963 web
https://github.com/go-gitea/gitea/commit/c453d09c36fad094405314dba2f370434b200711 web
https://blog.gitea.com/release-of-1.26.0 web
https://github.com/go-gitea/gitea package
https://github.com/go-gitea/gitea/releases/tag/v1.26.0 web