Gitea CVE-2026-96580

Requires (1) Gitea Actions enabled on the target repository and (2) an account permitted to open a pull request from a fork against that repository; the attacker submits a workflow file containing a static strategy.matrix that expands to a very large number of job combinations. The critical enabling flaw is ordering: the Cartesian-product expansion occurred when creating the run, BEFORE the fork pull-request approval gate, so a maintainer never needs to approve the malicious run. No self-hosted runner is required. Limiting factors: exploitation needs the ability to open fork PRs (an authenticated user on most instances; effectively low-friction on instances with open registration), Actions must be enabled, and only instances running Gitea ≤1.27.3 are affected - version 28.0.0 rejects static matrices above 256 combinations before expansion.

This is a moderate, not top-tier, priority. The official CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) rates it high purely on availability impact, but multiple signals temper the urgency. EPSS is 0.16% (4th percentile), SSVC lists Exploitation as 'none' and Technical Impact as only 'partial', and it is NOT on CISA KEV - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The one aggravating signal is SSVC Automatable=yes, meaning the trigger (submitting a crafted workflow file) is trivially scriptable once an attacker has PR access. There is a notable tension in the data: the CVSS vector claims PR:N (unauthenticated), yet the description explicitly requires 'a user who can open a pull request from a fork,' which on most Gitea deployments requires an authenticated account - so the true privilege requirement is closer to PR:L and the real-world score is likely ~6.5, not 7.5. Net: a credible self-inflicted/insider or open-registration-instance DoS risk worth patching promptly, but not an emergency given low EPSS, no KEV, and partial (availability-only) impact.

On a Gitea instance with Actions enabled and open or low-friction registration, an attacker creates an account, forks a target repository, and opens a pull request containing a tiny workflow file whose static strategy.matrix is defined to expand to an enormous Cartesian product (e.g., several dimensions multiplying into millions of jobs). Because matrix expansion happens when the run is created - before the fork-PR approval gate - Gitea attempts to materialize all job combinations, exhausting server memory and potentially killing the process. No self-hosted runner is required, and no public exploit code has been identified at time of analysis.