Go/code.gitea.io/gitea CVE-2026-58436: high 7.5, EPSS 0.61%
Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Action: Upgrade code.gitea.io/gitea to 1.27.0 or later.
go get code.gitea.io/gitea@v1.27.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.27.0 | - |
Fixed versions
| 1.27.0 |
Sources
- osv: GHSA-fw57-jgch-pgf3
- nvd: CVE-2026-58436
- https://github.com/go-gitea/gitea/security/advisories/GHSA-fw57-jgch-pgf3
- https://github.com/go-gitea/gitea/pull/38323
- https://github.com/go-gitea/gitea/commit/f452c369acc9f1bd05ec6ef9c2e4399062dd6da1
- https://github.com/go-gitea/gitea
CVE-2026-58436 · published · modified · JSON