Threats tagged 'ghsa-4xjf-493q-98p3'

Gitea versions prior to 1.27.0 have a denial of service vulnerability in the SSH key ingestion endpoint. The flaw is due to an O(N²) string concatenation loop in the SSH2 key normalization function that lacks input size limits. An authenticated user can submit a maliciously large SSH2 formatted key, causing excessive CPU and memory usage that may take the server offline. This vulnerability is identified as CVE-2026-56657 and is classified as a moderate severity issue. A patch is available to address this vulnerability.