CVE-2026-96580

Executive Summary

CVE-2026-96580 is a denial-of-service vulnerability in the Gitea self-hosted Git service (CWE-400, Uncontrolled Resource Consumption). When creating a workflow run, Gitea expands a workflow's static strategy.matrix into its full Cartesian product without a size limit, and this expansion occurs before the fork pull request approval gate is applied. Any user able to open a pull request from a fork can submit a small workflow file whose matrix expands to a very large number of jobs, exhausting server memory and potentially terminating the Gitea process — with no CI runner required. This impacts the availability of the Gitea instance and any dependent developer workflows; no public PoC or exploit code is known.

Technical Analysis

The flaw resides in Gitea's Actions/workflow processing pipeline, specifically in the logic that handles a workflow's static strategy.matrix definition. In GitHub Actions-compatible workflow syntax, strategy.matrix allows a job to declare sets of parameter values; the runner/controller expands these sets into the full Cartesian product, producing one job per combination. For example, a matrix with os: [a,b,c] and version: [1,2,3] expands to nine jobs.

The vulnerability mechanism is uncontrolled resource consumption (CWE-400): Gitea performs this Cartesian expansion without enforcing an upper bound on the number of resulting combinations. By design, Cartesian products grow multiplicatively, so a mathematically small workflow file — a handful of matrix keys with only a modest number of values each — can expand to an enormous number of discrete jobs. Multiplying, say, several axes of values yields exponential growth in memory consumption for job structures.

Critically, two ordering conditions create the exposure:

1. Expansion precedes the approval gate. The NVD description states the expansion happens "before the fork pull request approval gate applied." Gitea normally requires maintainer approval for workflow runs originating from fork pull requests, precisely to prevent untrusted code from executing. Because matrix expansion occurs prior to this gate, the resource-consuming computation is triggered without maintainer consent.
2. No runner is required. The expansion itself is the attack surface, not execution of the jobs. This means an attacker does not need any workflow to be scheduled on a runner, and the classic mitigating control of gating runner execution provides no protection.

The consequence is that the Gitea process allocates memory proportional to the (unbounded) expanded job count. Under sufficient expansion, the process exhausts available memory and can be terminated by the operating system's OOM killer or crash. The provided fix guidance — "Static matrices above 256 combinations are now rejected before expansion" — confirms the intended control: a pre-expansion cap on combination count. Note that this report must not speculate on internal function names, file paths, or endpoints; none are provided in the source data.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (CWE-400) and the behavior described in the NVD entry. Only terms appearing in the source description — strategy.matrix, fork pull request, approval gate, Cartesian product, workflow — are used.

1. Reconnaissance / target identification. The attacker identifies a reachable, self-hosted Gitea instance that has Actions/workflows enabled (the feature that processes strategy.matrix). The attacker needs only a user account capable of forking a repository and opening a pull request.

2. Triggering the flaw class. The attacker forks a target repository and creates a minimal workflow file that defines a static strategy.matrix spanning several keys with multiple values each, such that the Cartesian product yields a very large number of combinations. Because expansion happens before the fork pull request approval gate, no maintainer action is needed to cause the expansion.

3. Payload / execution at the vulnerability-class level. The "payload" is the workflow's matrix definition itself — a small text file whose declarative size is disproportionate to the combinatorial size of its expansion. No runner, no shell command, and no code execution are required; the resource consumption is a side effect of Gitea's expansion of the matrix into jobs.

4. Post-exploitation impact. Memory consumed during expansion grows with the combination count, eventually exhausting server memory and potentially terminating the Gitea process (denial of service). The attack may be repeated or parallelized across forks/PRs to sustain or amplify unavailability. There is no confidentiality or integrity impact described; the effect is purely availability degradation or outage.

Impact Assessment

The impact is availability-focused. An unauthenticated user (outside the project's maintainer set) — specifically any user who can open a fork pull request — can cause memory exhaustion that terminates the Gitea process, disrupting Git hosting, code review, issue tracking, package registry, and CI/CD orchestration for all users of the instance. Because no runner execution is required, standard CI isolation controls do not help.

Business consequences include developer productivity loss, blocked release pipelines, and potential collateral impact to services integrating with the Gitea instance (webhooks, mirrors, CI triggers). The official CVSS score and vector are not available (N/A from NVD); the analyst-assigned vector above (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects network reachability, low complexity, the low privilege of "able to open a fork pull request," no user interaction, and high availability impact. EPSS has not been scored by FIRST.org and no CISA KEV listing exists; exploitation in the wild is not evidenced. Blast radius is bounded by instance resource limits and any external process supervision (e.g., container memory limits, systemd restart policies) that may reduce duration of outage.

Detection Guidance

Detection focuses on workflow files with unusually large static matrix definitions, bursts of fork-PR workflow creation, and Gitea process memory exhaustion/OOM events.

Sigma Rule

title: Gitea Excessive Static Matrix Expansion (CVE-2026-96580)
id: 8f2d1c4a-9b3e-4c7d-a1f0-2d6e7b9c0a13
status: experimental
description: Detects workflow files defining static strategy.matrix configurations that can expand to very large Cartesian products, consistent with CVE-2026-96580 resource exhaustion.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96580
author: valtersit.com
date: 2026-01-01
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|endswith:
      - '.gitea/workflows/'
      - '.github/workflows/'
  selection_matrix:
    - TargetFilename|endswith: '.yml'
    - TargetFilename|endswith: '.yaml'
  keywords:
    - 'strategy:'
    - 'matrix:'
  condition: selection_path and selection_matrix and keywords
falsepositives:
  - Legitimate large build matrices in trusted repositories
level: medium
tags:
  - attack.t1499
  - cve.2026.96580

YARA Rule

rule CVE_2026_96580_Gitea_Matrix_DoS
{
    meta:
        author = "valtersit.com"
        description = "Detects Gitea workflow files with static strategy.matrix definitions potentially causing resource exhaustion (CVE-2026-96580)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96580"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s1 = "strategy:" ascii nocase
        $s2 = "matrix:" ascii nocase
        $s3 = "jobs:" ascii nocase

    condition:
        filesize < 100KB and all of ($s1, $s2, $s3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96580 Gitea Fork PR Workflow Matrix DoS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/pulls"; nocase; http.request_body; content:"strategy"; nocase; http.request_body; content:"matrix"; nocase; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-dos; reference:cve,2026-96580; sid:202696580; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ file where file.name : ("*.yml" or "*.yaml") and file.path : "*.gitea/workflows/*" ]
  [ process where event.action : "start" and process.name : "gitea" and process.thread.name : "*matrix*" ]

Splunk SPL Query

index=gitea sourcetype=gitea:server OR sourcetype=gitea:actions
| search ("strategy" AND "matrix") OR "expanding matrix" OR "too many jobs"
| stats count by src_ip, user, repo, workflow
| where count > 10
| sort - count

Wazuh OSSEC Rule

<group name="gitea,cve-2026-96580,">
  <rule id="100965" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">matrix</field>
    <match>strategy|expand|combination</match>
    <description>CVE-2026-96580: Possible Gitea workflow matrix expansion resource exhaustion</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Enforce a matrix combination limit at the workflow-processing layer consistent with the described fix (reject static matrices above 256 combinations before expansion). Where Gitea cannot yet enforce this, restrict who can open fork pull requests (disable fork PR workflows or require trusted contributors) to eliminate the untrusted-actor path.
   • Apply OS/container-level memory limits (cgroup) and supervised restarts for the Gitea process to bound the duration and severity of any OOM termination.
   • Monitor for and rate-limit bursts of fork PRs and workflow file creation.

2. Patch/upgrade steps:

   • No vendor advisory, commit, or fixed version is available in the provided data. Administrators should track Gitea's official release notes and security advisories, and upgrade to the first release that documents the pre-expansion matrix combination cap.
   • Until a fix version is confirmed, treat the instance as vulnerable and apply the compensations above.

3. Long-term hardening:

   • By design, validate and bound all user-supplied combinatorial inputs (matrix keys and values) before expensive expansion; perform authorization/approval checks before resource-intensive operations on fork-originated content.
   • Enable structured logging of workflow processing failures and job-count anomalies, and integrate alerts (Sigma/Suricata/Splunk/Wazuh rules above) into the SOC.

References

• NVD — CVE-2026-96580: https://nvd.nist.gov/vuln/detail/CVE-2026-96580
• MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CWE-400 Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• FIRST EPSS — not yet scored (no value available): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — no KEV listing for CVE-2026-96580: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-96580 at this time; no public PoC, exploit code, or Nuclei template is available in the provided data.