CVE-2021-3382 Buffer Overflow in gitea

What is CVE-2021-3382?

CVE-2021-3382 is a high-severity memory corruption vulnerability in Gitea Gitea, published on 5 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path.

Weakness: CWE-787

Which versions are affected by CVE-2021-3382?

4 open source packages ship an affected version, including github.com/go-gitea/gitea, gitea and code.gitea.io/gitea. It affects 1 product.

Products include Gitea Gitea.

How do I fix CVE-2021-3382?

Upgrade github.com/go-gitea/gitea to 1.13.2 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-3382 being exploited?

There is no known exploitation of CVE-2021-3382 in the wild and no public exploit code.

Other vulnerabilities in Gitea Gitea

• CVE-2026-60004 Gitea Code Injection Exploited Critical 9.8
• CVE-2026-73278 Gitea WebAuthn bypass during OAuth and OIDC sign-in Critical 9.8
• CVE-2026-94205 Gitea fork workflow approval bypass through maintainer-triggered events Critical 9.8
• CVE-2022-42968 Gitea vulnerable to Argument Injection Critical 9.8
• CVE-2021-45330 Improper Privilege Management in Gitea Critical 9.8

All Gitea Gitea vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-gitea-2021-3382, CLEANSTART-2025-DZ77580, GHSA-9f8c-pfvv-p4gm, GO-2024-2757.