The vulnerability arises when the pre‑receive hook in Gitea reads push data with a bufio.Scanner. On encountering a scanning error, often caused by an oversized payload, the hook exits early without performing branch‑protection checks. The result is that a push that would normally be rejected can be accepted, allowing an attacker with push rights to inject malicious code into protected branches. The weakness is classified as CWE‑863: Failure to Consider All Exhaustive or Alternate Conditions. This effectively compromises the integrity of protected repositories.

The vulnerability affects the open‑source Gitea Git server. All releases earlier than 1.26.0 are impacted. In versions before 1.26.0, the hook uses a bufio.Scanner to read the push data. If the scanner encounters an error—often caused by an oversized payload—the hook exits without performing the branch‑protection checks. This flaw allows a push that would normally be blocked to be accepted, effectively compromising the integrity of protected branches.

The CVSS score of 9.8 denotes a critical severity, yet the EPSS score of less than 1% indicates that exploitation is not currently prevalent. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must have push access to a repository to trigger the flaw. Once the hook bypasses branch‑protection, any commits created by the attacker will be accepted, potentially introducing malicious code into protected branches.