Cyber Resilience

CVE-2026-26307

DoS

Published
03 July 2026
Modified
09 July 2026
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0047 38th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-26307 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application Exhaustion Flood (T1499.003); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-6 (Resource Availability) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.003 Application Exhaustion Flood Impact
Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.
Why these techniques?

CWE-400 resource exhaustion via unauthenticated/unauthorized expensive git grep operations directly enables application-layer DoS by flooding server CPU/memory.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-6599Shared CWE-400
CVE-2023-51316Shared CWE-400
CVE-2026-30955Shared CWE-400
CVE-2025-52636Shared CWE-400
CVE-2026-34677Shared CWE-400
CVE-2024-24827Shared CWE-400
CVE-2026-44242Shared CWE-400
CVE-2026-27859Shared CWE-400
CVE-2024-45626Shared CWE-400
CVE-2026-9137Shared CWE-400

Affected Assets

Gitea
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-6 Resource Availability
  • SI-10 Information Input Validation
Detect
Catch it (NIST detect / respond)
  • AU-12 Audit Record Generation
Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

SC-6 requires protection against resource exhaustion; enforcing timeouts on git grep directly prevents the unbounded CPU/memory consumption described in CVE-2026-26307.

prevent

SI-10 mandates validation of inputs; limiting or rejecting overly expensive search parameters would stop the resource-exhaustion vector before it reaches the git layer.

detect

AU-12 requires logging of security-relevant events; capturing long-running or high-CPU git grep invocations would allow detection of attempted or successful resource-exhaustion attacks.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.IR-04 mostly match
prevents

Explicitly requires monitoring and maintaining resource capacity, directly addressing uncontrolled consumption to preserve availability.

DE.CM-09 partial match
prevents

Continuous monitoring of computing resources can detect resource exhaustion but does not itself enforce allocation limits.

PR.IR-03 partial match
prevents

Resilience mechanisms such as avoiding single points of failure indirectly reduce impact of resource exhaustion.

PR.PS-01 partial match
prevents

Hardened configuration baselines can include resource quotas and limits that constrain consumption.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Resource-utilization monitoring and alerting on bottlenecks or overloads limits the impact of denial-of-service or resource-exhaustion attacks.

prevents

By continuously monitoring utilization, stress-testing peak loads, and maintaining documented plans to scale or throttle resources, the control directly limits an attacker’s ability to drive a system into uncontrolled resource exhaustion.

detects

Pre-agreed severity-based prioritization and resource allocation during incident triage reduce the likelihood that an attacker-induced resource exhaustion will overwhelm the organization before corrective action is taken.

mitigates

Business-continuity plans that include resource-management controls reduce the likelihood that an attacker can trigger uncontrolled resource consumption by forcing the system into a degraded or fallback state.

mitigates

Defining RTOs and capacity requirements for ICT services during business-impact analysis forces organizations to provision sufficient resources and throttling mechanisms, reducing the likelihood that an attacker can induce denial-of-service through uncontrolled resource consumption.

detects

Early notification of anomalous resource consumption or system malfunctions enables throttling or isolation before availability is lost.

References