CVE-2026-58421: Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service
This issue has been found by a security agent and review by myself.
Gitea’s CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to write a pattern that causes the regex engine to backtrack exponentially when evaluated against a crafted file path.
References
- blog.gitea.com/release-of-1.26.3-and-1.26.4
- github.com/advisories/GHSA-v96j-25gv-g2w9
- github.com/go-gitea/gitea/commit/ea35af1b68d57522c7686618bd61d3216d91589f
- github.com/go-gitea/gitea/pull/38011
- github.com/go-gitea/gitea/releases/tag/v1.26.4
- github.com/go-gitea/gitea/security/advisories/GHSA-v96j-25gv-g2w9
- nvd.nist.gov/vuln/detail/CVE-2026-58421
Code Behaviors & Features
Detect and mitigate CVE-2026-58421 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →