CVE-2026-95112

Executive Summary

CVE-2026-95112 is an algorithmic complexity (quadratic time) denial-of-service vulnerability in Gitea's issue and comment body processing. When rendering submitted Markdown, the application re-scans the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, making processing time quadratic in the size of the input. Any authenticated user permitted to submit issue or comment content can supply a crafted body of approximately 1 MB that occupies a CPU core for several minutes while holding a database transaction open, degrading or halting service for all users.

Technical Analysis

The vulnerability resides in Gitea's processing of issue and comment bodies — specifically the logic that identifies action keywords (for example "closes" or "fixes") used to automatically link issues and trigger state transitions (such as closing a referenced issue). According to the NVD description, this logic "scanned the entire preceding text for action keywords such as 'closes' or 'fixes' once per Markdown link."

The defect is architectural rather than a memory-safety flaw. For each Markdown link present in the submitted body, the parser performs a scan across all text that precedes that link. If a body contains N links, the parser performs N scans, each covering a progressively larger span of text. The total work therefore grows quadratically (O(N²)) with input size rather than linearly. This is a classic inefficient-algorithmic-complexity condition (CWE-407), not a bounds or injection issue.

The critical compounding factor described is transaction duration: while the costly scan executes, a database transaction is held open. A single crafted ~1 MB body is sufficient to keep a CPU core busy for several minutes. Because the work is CPU-bound and tied to a long-lived transaction, the request cannot be cheaply cancelled or shed, and concurrent submissions of the same kind compound the resource exhaustion (crowding CPU cores and holding multiple database transactions simultaneously).

Attack surface: the authenticated issue/comment submission path. No authentication bypass, privilege escalation, or memory corruption is involved; the only prerequisite is a valid account with permission to create issues or comments. The attack is therefore reachable by any low-privileged authenticated user against any Gitea instance that has not yet been fixed. No public exploit code or PoC is available, and no patch has been published by any tracked source.

Exploitation Scenarios

Because no public PoC exists, the chain below is inferred at the vulnerability-class level from the NVD description. No specific function names, endpoints, or parameters beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies a reachable Gitea instance, typically by recognizing the Gitea web UI on the issue/comment submission interfaces. Open-registration instances or instances where the attacker already holds a low-privileged account are prime targets.

2. Prerequisite. The attacker authenticates (or registers) and obtains permission to create an issue or post a comment — the minimum access needed to reach the body-processing code path.

3. Triggering the flaw class. The attacker crafts a body of approximately 1 MB containing a large number of Markdown links interspersed with text. Because the vulnerable code re-scans all preceding text for action keywords once per link, the processing cost scales quadratically. Submitting this crafted body forces the parser into minutes of CPU-bound work on a single core while a database transaction remains open.

4. Payload / execution at the class level. The "payload" is simply the crafted Markdown body itself — no code execution is required. The attacker submits it through the normal issue or comment submission flow. Timing the submission or repeating it across multiple issues, comments, or accounts multiplies the effect (multiple cores saturated, multiple transactions held open).

5. Post-exploitation impact. The immediate outcome is resource exhaustion: CPU cores are consumed and database transactions are held, increasing latency and ultimately rendering the instance unresponsive to legitimate users. The attacker gains no data access or code execution; the objective is denial of service and, at scale, sustained unavailability.

Impact Assessment

Impact is availability-focused. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects a network-reachable (AV:N) issue with low attack complexity (AC:L) that requires only low privileges (PR:L, an authenticated user) and no user interaction (UI:N). Confidentiality and integrity impacts are None; the availability impact is High because a modest ~1 MB input consumes a CPU core for several minutes while holding a database transaction open.

Blast radius: any unpatched Gitea instance that exposes issue/comment creation to authenticated users. In multi-tenant or public-facing deployments with open registration, the exploitable population is effectively any registered user, and repeated/parallel submissions can saturate all available CPU cores and hold many long-lived database transactions, degrading the service for the entire user base. Because no patch and no CVSS score are published (score N/A), severity must be managed from the described behavior alone; the practical risk maps to a high-availability-impact, low-complexity, authenticated DoS.

Detection Guidance

Sigma Rule

title: Gitea Quadratic-Time Issue/Comment Body DoS Attempt
id: 7c2f1e9a-4b3d-4a6e-9f21-0c5d8ab13e77
status: experimental
description: Detects submission of abnormally large issue or comment bodies consistent with CVE-2026-95112 quadratic-time keyword scanning.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95112
author: valtersit.com
date: 2026-01-01
logsource:
  product: gitea
  service: http
detection:
  selection_method:
    http.method:
      - POST
      - PATCH
  selection_path:
    http.url|contains:
      - '/issues'
      - '/comments'
  selection_size:
    http.request.body.bytes|gte: 900000
  selection_links:
    http.request.body|contains: '](http'
  condition: selection_method and selection_path and selection_size and selection_links
falsepositives:
  - Legitimate very large issue bodies containing many links
level: medium
tags:
  - attack.t1499
  - cve.2026.95112

YARA Rule

rule CVE_2026_95112_Gitea_Quadratic_Body_DoS
{
    meta:
        description = "Detects large issue/comment request bodies with many Markdown links consistent with CVE-2026-95112 quadratic keyword scanning"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95112"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $close_kw = "closes" ascii nocase
        $fix_kw   = "fixes" ascii nocase
        $md_link  = "](http" ascii

    condition:
        filesize > 900KB and
        #md_link > 500 and
        (any of ($close_kw, $fix_kw))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-95112 Gitea Quadratic Issue/Comment Body DoS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/issues"; http.request_body; content:"](http"; threshold: type both, track by_src, count 3, seconds 60; classtype:attempted-dos; reference:cve,2026-95112; sid:202695112; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [http where http.request.method == "POST" and
    wildcard(http.request.uri, "/issues*") and
    http.request.body.bytes >= 900000]
  [http where http.request.method == "POST" and
    wildcard(http.request.uri, "/issues*") and
    http.request.body.bytes >= 900000]

Splunk SPL Query

index=web sourcetype=gitea_access
| eval body_bytes=coalesce(http_request_body_bytes, request_body_size)
| where http_method IN ("POST","PATCH")
    AND (uri_path LIKE "%/issues%" OR uri_path LIKE "%/comments%")
    AND body_bytes >= 900000
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path
| where count >= 2
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="gitea,web,attack,">
  <rule id="202695" level="10">
    <decoded_as>json</decoded_as>
    <field name="http_method">POST|PATCH</field>
    <field name="uri_path" type="pcre2">/issues|/comments</field>
    <field name="body_bytes" type="pcre2">^\d{6,}$</field>
    <description>CVE-2026-95112: Possible large Gitea issue/comment body DoS attempt (quadratic keyword scan), bytes=$(body_bytes)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_95112,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix and no workaround are documented in the provided data; the guidance below is operational and does not assume a specific code change.

1. Immediate mitigations

   • Enforce strict request body size limits at the reverse proxy (nginx, HAProxy, Traefik) for issue/comment submission endpoints, well below the ~1 MB figure used in the description.
   • Add rate limiting per authenticated user and per source IP on issue/comment creation to prevent concurrent submissions that saturate CPU cores and hold multiple database transactions.
   • Restrict issue/comment creation to trusted users where operationally feasible (disable open registration or gate posting behind approval) to reduce the authenticated attacker population.
   • Monitor CPU saturation and long-running database transactions on the Gitea backend; alert when a single submission correlates with multi-minute CPU consumption.

2. Patch / upgrade steps

   • No patch is available at this time. Continuously monitor the Gitea project's security advisories, release notes, and the NVD entry for CVE-2026-95112 for an official fix.
   • When a fix publishes, upgrade immediately and verify the release notes explicitly reference this CVE or the quadratic keyword-scan behavior.

3. Long-term hardening

   • Apply the principle of least privilege to account provisioning so the minimum number of users can create issues and comments.
   • Keep reverse-proxy body-size limits and rate limits as a permanent layer, not a temporary workaround.
   • Track the upstream repository/release channel so availability-impacting fixes are applied promptly.
   • Instrument application-level timing for body processing to detect algorithmic-complexity regressions early.

References

• NVD — CVE-2026-95112: https://nvd.nist.gov/vuln/detail/CVE-2026-95112
• Gitea project security advisories and releases: https://github.com/go-gitea/gitea/releases
• Gitea security disclosure policy/advisories: https://github.com/go-gitea/gitea/security/advisories
• CWE-407 — Inefficient Algorithmic Complexity: https://cwe.mitre.org/data/definitions/407.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-95112 in the provided data. CISA KEV status: NO. No public PoC or exploit code is known.