CVE-2026-27780: Gitea pre-receive hook scanner errors allow branch-protection bypass

July 3, 2026 (updated September 1, 2026)

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

References

blog.gitea.com/release-of-1.26.0
github.com/advisories/GHSA-vhq7-fwwh-7hjf
github.com/go-gitea/gitea/commit/c453d09c36fad094405314dba2f370434b200711
github.com/go-gitea/gitea/pull/36963
github.com/go-gitea/gitea/releases/tag/v1.26.0
nvd.nist.gov/vuln/detail/CVE-2026-27780

Code Behaviors & Features

Detect and mitigate CVE-2026-27780 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →