What is the CVSS score of CVE-2026-58421?

CVE-2026-58421 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Gitea are affected by CVE-2026-58421?

Gitea instances running versions before 1.26.3 are vulnerable to a denial-of-service attack that could force service outages, halting critical development infrastructure with no authentication…. A patch is available.

How to fix or mitigate CVE-2026-58421?

Within 24 hours: Inventory all Gitea deployments and confirm versions currently in use. Within 7 days: Upgrade all instances running versions prior to 1.26.3 to Gitea 1.26.3 or 1.26.4. Within 30 days: Verify patch deployment across all environments and document completion with version confirmation in change management records.

Gitea CVE-2026-58421

EUVD-2026-41604 HIGH

Improper Access Control (CWE-284)

2026-07-03 Gitea

GHSA-v96j-25gv-g2w9

Authentication Bypass Denial Of Service Gitea Open Source Git Server Suse

7.5

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, low-complexity, unauthenticated ReDoS reachable over the network with no user interaction; availability-only impact, no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 16:34 vuln.today

CVSS changed

Jul 06, 2026 - 16:22 NVD

7.5 (HIGH)

CVE Published

Jul 03, 2026 - 20:54 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

AnalysisAI

Denial of service in Gitea, the self-hosted open-source Git service, allows a remote unauthenticated attacker to exhaust server CPU by triggering catastrophic backtracking in the regular-expression engine that evaluates CODEOWNERS pattern matching. All versions prior to the fixed 1.26.3/1.26.4 releases are affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H only) confirms network-reachable, low-complexity, no-authentication abuse with availability-only impact. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), so exploitation risk is real but not yet widespread.

Technical ContextAI

The flaw is a Regular Expression Denial of Service (ReDoS): Gitea parses repository CODEOWNERS files and compiles the ownership patterns into regular expressions, and a maliciously crafted pattern (or crafted input matched against it) causes catastrophic backtracking that consumes disproportionate CPU time. The affected component is the Gitea Open Source Git Server (cpe:2.3:a:gitea:gitea_open_source_git_server), a Go-based self-hosted Git forge comparable to GitHub/GitLab. The CVE is labeled CWE-284 (Improper Access Control), but that classification appears inaccurate for the described behavior - the actual root cause is an inefficient/uncontrolled regular expression (functionally CWE-1333 ReDoS / CWE-400 uncontrolled resource consumption), which the CVSS availability-only impact profile corroborates.

RemediationAI

Vendor-released patch: upgrade Gitea to 1.26.4 (or at minimum 1.26.3), which contain the fix per the release blog (https://blog.gitea.com/release-of-1.26.3-and-1.26.4/) and the tagged release https://github.com/go-gitea/gitea/releases/tag/v1.26.4; the code change is in pull request https://github.com/go-gitea/gitea/pull/38011 and is described in advisory GHSA-v96j-25gv-g2w9. If immediate upgrade is not possible, reduce exposure by placing the Gitea instance behind authentication or a reverse proxy that rate-limits and time-limits requests to CODEOWNERS-triggering endpoints, and restrict who can create or modify repositories containing CODEOWNERS files - with the trade-off that rate-limiting can affect legitimate CI/automation traffic and restricting repo creation limits normal collaboration. These are stopgaps only; the regex fix in the patched release is the reliable remedy.