CVE-2026-56657
published 2026-08-13CVE-2026-56657: code.gitea.io/gitea: Gitea: Denial of Service in SSH Key Parser A flaw was found in Gitea. The SSH Key Parser component is vulnerable to a denial of service. A…
medium6.2CVSS 3.1
AVLACLPRNUINSUCNINAH
EPSS
0.23%
13.9th percentile
code.gitea.io/gitea: Gitea: Denial of Service in SSH Key Parser
A flaw was found in Gitea. The SSH Key Parser component is vulnerable to a denial of service. A remote attacker could potentially exploit this by submitting a specially crafted SSH key, leading to the unavailability of the Gitea service.
Statement: This is a Moderate impact denial of Service vulnerability in the Gitea SSH key parser. Red Hat products are not affected as they do not expose any endpoint that ingest SSH key using Gitea. Products that import from code.gitea.io/gitea only compile the modules/structs and modules/json subpackages.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: openshift-pipelines-client (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipelines-cli-tkn-rhel9 (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipelines-opc-rhel9 (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9 (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9 (OpenShift Pipelines) - Not affected
Package: openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9 (OpenShift Pipelines) - Not affected
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
CVSS provenance
nvdv3.16.2MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
code.gitea.io/gitea: Gitea: Denial of Service in SSH Key Parser
vendor_redhat·2026-08-13·CVSS 6.2
CVE-2026-56657 [MEDIUM] CWE-770 code.gitea.io/gitea: Gitea: Denial of Service in SSH Key Parser
code.gitea.io/gitea: Gitea: Denial of Service in SSH Key Parser
A flaw was found in Gitea. The SSH Key Parser component is vulnerable to a denial of service. A remote attacker could potentially exploit this by submitting a specially crafted SSH key, leading to the unavailability of the Gitea service.
Statement: This is a Moderate impact denial of Service vulnerability in the Gitea SSH key parser. Red Hat products are not affected as they do not expose any endpoint that ingest SSH key using Gitea. Products that import from code.gitea.io/gitea only compile the modules/structs and modules/json subpackages.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment,
GHSA
Gitea SSH Key Parser Denial of Service
ghsa·2026-07-21
CVE-2026-56657 [MEDIUM] CWE-400 Gitea SSH Key Parser Denial of Service
Gitea SSH Key Parser Denial of Service
Gitea's SSH key ingestion endpoint accepts keys in RFC 4716 (SSH2) format and normalises them before storage. The normalisation function contains an O(N²) string concatenation loop with no input size limit, meaning a single malicious key submission can force the server to perform an amount of work that grows quadratically with the size of the input. Any authenticated user can exploit this to exhaust the server's CPU and memory, taking the instance offline.
### Root Cause
An attacker sends a POST /api/v1/user/keys request with a Bearer token and a JSON body whose key field contains a malicious RFC 4716 (SSH2) public key. The key consists of a valid SSH2 header followed by a very large number of short content lines — for example, 400,000 lines of 100
No detection rules found.
No public exploits indexed.
2026-08-13
Published