{"id":"EUVD-2026-41638","enisaUuid":"db340c7d-13b3-3838-b730-b0d8d25862e7","description":"Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.","datePublished":"Jul 3, 2026, 8:19:37 PM","dateUpdated":"Jul 6, 2026, 3:20:06 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/go-gitea/gitea/pull/36963\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.0\nhttps://blog.gitea.com/release-of-1.26.0/\n","aliases":"CVE-2026-27780\nGHSA-vhq7-fwwh-7hjf\n","assigner":"Gitea","epss":0.64,"enisaIdProduct":[{"id":"252a4eb9-84ff-3c8b-8ebd-75a05748633f","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.26.0"}],"enisaIdVendor":[{"id":"f72181e9-8441-3b7f-8da5-09b6913b1056","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"bec67711-8e5f-34d4-abe0-aeca485f8e72","vulnerability":{"id":"CVE-2026-27780","description":"Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.","datePublished":"Jul 3, 2026, 8:19:37 PM","dateUpdated":"Jul 6, 2026, 3:20:06 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/go-gitea/gitea/pull/36963\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.0\nhttps://blog.gitea.com/release-of-1.26.0/\n","enisa_id":"EUVD-2026-41638\n","assigner":"Gitea","epss":0.64,"dataProcessed":"Nov 3, 2026, 7:17:20 AM","vulnerabilityProduct":[{"id":"3c5c722f-b5f1-365c-a7c7-365ebbec0ca7","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 \u003c1.26.0"}],"vulnerabilityVendor":[{"id":"5e7f2759-9c8f-358c-8be7-15c674c07aff","vendor":{"name":"Gitea"}}]}},{"id":"d7732029-caf2-31e4-bdb9-9bdaa2ee1f46","vulnerability":{"id":"GHSA-vhq7-fwwh-7hjf","description":"Gitea pre-receive hook scanner errors allow branch-protection bypass","datePublished":"Jul 3, 2026, 9:31:38 PM","dateUpdated":"Sep 1, 2026, 6:55:25 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-27780\nhttps://github.com/go-gitea/gitea/pull/36963\nhttps://github.com/go-gitea/gitea/commit/c453d09c36fad094405314dba2f370434b200711\nhttps://blog.gitea.com/release-of-1.26.0\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.0\n","enisa_id":"EUVD-2026-41638\n","aliases":"GHSA-vhq7-fwwh-7hjf\nCVE-2026-27780\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}