CVE-2026-55984
published 2026-08-13CVE-2026-55984: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
PriorityP410low2.7CVSS 3.1
AVNACLPRHUINSUCNINAL
EPSS
0.34%
26.0th percentile
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
| gitea | gitea_open_source_git_server | <= 1.26.4 | — |
CVSS provenance
nvdv3.12.7LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
vendor_redhat2.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
code.gitea.io/gitea: Gitea: Denial of Service via Null Pointer Dereference in AddTime API
vendor_redhat·2026-08-13·CVSS 2.7
CVE-2026-55984 [LOW] CWE-476 code.gitea.io/gitea: Gitea: Denial of Service via Null Pointer Dereference in AddTime API
code.gitea.io/gitea: Gitea: Denial of Service via Null Pointer Dereference in AddTime API
A flaw was found in Gitea. An authenticated attacker could exploit a null pointer dereference within the AddTime API. This can lead to a denial of service (DoS), making the application unavailable to legitimate users.
Package: openshift-pipelines-client (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipelines-cli-tkn-rhel9 (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipelines-opc-rhel9 (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9 (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9 (OpenShift Pipelines) - Not affected
Package: openshift-pi
GHSA
Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
ghsa·2026-07-21
CVE-2026-55984 [LOW] CWE-476 Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
### Summary
The AddTime API handler continues execution after an error returned by `GetUserByName()`.
When a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime panic.
### Details
Affected endpoint:
```http
POST /api/v1/repos/{owner}/{repo}/issues/{index}/times
```
Affected file:
```text
routers/api/v1/repo/issue_tracked_time.go
```
Relevant code:
```go
user, err = user_model.GetUserByName(ctx, form.User)
if err != nil {
ctx.APIErrorInternal(err)
// missing return
}
```
Execution continues to:
```go
trackedTime, err := issues_model.AddTime(
ctx,
user,
iss
No detection rules found.
No public exploits indexed.
2026-08-13
Published