Gitea CVE-2026-96399

Requires an actor who can edit a repository's external issue tracker settings (a repository administrator; on instances allowing self-service repo creation, effectively any authenticated user via their own repo) and who sets a malicious external-tracker regular expression using alternating capture groups. The crash then fires whenever matching content is rendered for any viewer, such as a README. Limiting factors: the external issue tracker must be configurable by the attacker and populated with the crafted regex (not a default configuration), and privileges over repo settings are needed - so despite the input's PR:N, this is not exploitable against a default install by a fully anonymous attacker unless open registration plus repo creation is permitted.

Signals here are moderate and partly conflicting. The authoritative CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) scores this as a remotely reachable, no-privilege, availability-only flaw. However, the description explicitly states the attacker must be 'a user who can edit a repository's external issue tracker settings,' which is a repo-administrator action - so PR:N likely understates the privilege requirement and should be treated as PR:L/PR:H; this conflict should be verified against the GHSA advisory. The exploitation-likelihood signals are low-to-moderate: EPSS is 0.16% (4th percentile), SSVC reports Exploitation:none and Technical Impact:partial, and there is no CISA KEV listing - so there is no evidence of active exploitation (no public exploit identified at time of analysis). The mitigating privilege requirement is offset by a serious scope consideration: a single malicious repo configuration causes a runtime panic that terminates the whole Gitea process, denying service to ALL users of the instance, and SSVC marks it Automatable:yes. Net: this is a credible denial-of-service priority for multi-tenant/open-registration Gitea instances but not an emergency wormable network bug - it is lower real-world risk than the 7.5 'network/unauthenticated' reading alone implies, because an attacker first needs the ability to configure a repo's external tracker.

An attacker with the ability to configure a repository's external issue tracker (a repo admin, or any registered user on an open-registration instance using their own repo) sets a crafted external-tracker regular expression that uses alternating capture groups. When any user subsequently views content that matches the pattern - for example rendering that repository's README - Gitea computes invalid slice indexes and panics, terminating the process and taking the entire instance offline for all users. No public exploit is identified at time of analysis, though the upstream fix diff (PR #39354) reveals the root cause (unvalidated capture-group index in FindRenderizableReferenceRegexp).