Description

Gitea SSH Key Parser Denial of Service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-08-13T17:17:25.470Z",
  "pubdate": "2026-08-13T17:17:25.470Z",
  "executiveSummary": "This vulnerability involves a denial of service condition residing within the Gitea SSH key parser component.\nThe flaw allows an attacker to exhaust system resources, leading to service degradation or complete unavailability of the affected Gitea instance.\nThe vulnerability directly impacts Gitea deployments that utilize the vulnerable SSH key parsing functionality.\nThe risk implications include potential operational disruption, loss of service availability for developers relying on SSH operations, and resource exhaustion on the host operating system.\nAn attacker possessing the capability to interact with the SSH service or submit specially crafted SSH keys can trigger this condition.\nExploitation requirements depend on the ability to supply malicious input to the SSH key parser, often requiring network access to the Gitea SSH port without necessarily requiring authenticated administrative privileges depending on the exact submission vector.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input validation, algorithmic complexity issues, or unbounded resource consumption during the parsing of malformed or specially crafted SSH keys within the Gitea SSH key parser.\nThe vulnerable component is the internal parsing routine responsible for processing SSH public keys submitted by users for authentication or repository management purposes.\nWhen the parser processes a maliciously engineered SSH key payload, it may enter an inefficient processing loop, excessive memory allocation state, or recursive evaluation path.\nThe attack flow begins when an attacker transmits a crafted SSH key via supported interfaces, such as the user profile settings, API endpoints, or direct SSH handshake sequences.\nUpon receipt, the Gitea application passes the input string to the SSH key parser component.\nDue to the absence of strict size limits, parsing timeouts, or proper complexity checks, the parsing algorithm consumes excessive CPU cycles or depletes available system memory.\nThis anomalous payload behavior forces the host process into a resource-starved state, causing it to drop existing connections, fail subsequent authentication requests, or crash entirely, thereby achieving a denial of service.\nNetwork exposure is typically present via the exposed SSH daemon port or HTTP/HTTPS API endpoints used for public key management.\nDepending on the implementation context, authentication or specific privilege requirements may be minimal or non-existent if unauthenticated endpoints or registration workflows permit the submission of arbitrary SSH public keys."
}