CVE-2026-58421 Details
Description
Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
A denial-of-service vulnerability has been identified in Gitea versions prior to 1.26.2, allowing unauthenticated users to cause server hangs through malicious CODEOWNERS files. The issue arises from the CODEOWNERS feature's use of regular expressions for pattern matching, which can be exploited to create catastrophic backtracking scenarios. This vulnerability is triggered by pushing a CODEOWNERS file with a crafted pattern into a repository, then opening a pull request that includes a file named to exploit the regex matching process. The resulting backtracking can significantly delay the processing of the pull request, tying up database resources and causing the Gitea instance to become unresponsive.
Users are advised to upgrade to Gitea version 1.26.4, which includes a fix for this vulnerability by bounding the regex matching time to prevent denial-of-service.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 3, 2026CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-gitea/gitea/security/advisories/GHSA-v96j-25gv-g2w9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://blog.gitea.com/release-of-1.26.3-and-1.26.4/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/38011 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.26.4 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-v96j-25gv-g2w9 | Gitea Limited | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | < 1.26.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | Gitea Limited |