CVE-2026-55984 Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
An authenticated attacker can cause a denial of service in Gitea by triggering a null pointer dereference in the AddTime API.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55984?
CVE-2026-55984 is a low-severity vulnerability in Gitea Open Source Git Server, published on 13 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
Weakness: CWE-284
Which versions are affected by CVE-2026-55984?
3 open source packages ship an affected version, including code.gitea.io/gitea and gitea.dev.
| Package | Affected | Fixed in |
|---|---|---|
code.gitea.io/gitea Go | All versions | 1.27.0 |
code.gitea.io/gitea Go | All versions | 1.27.0 |
gitea.dev Go | All versions | 1.27.0 |
How do I fix CVE-2026-55984?
Upgrade code.gitea.io/gitea to 1.27.0 or later.
Is CVE-2026-55984 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55984 exists.
Sources
Also known as GHSA-m932-crvm-gcp5, GO-2026-6064, MINI-74cv-mq55-j5g5, MINI-7jr8-8xjr-mh6f.