PT-2026-36652 · Go+1 · Code.Gitea.Io/Gitea+4

Published 2026-04-22 · Updated 2026-05-29

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The built-in SSH server uses default configurations that advertise weak or broken key exchange, MAC, and host key algorithms. Specifically, the server supports the ecdh-sha2-nistp256, ecdh-sha2-nistp384, and ecdh-sha2-nistp521 key exchange algorithms, the hmac-sha1 MAC algorithm, and the ssh-rsa host key algorithm.

Recommendations As a temporary workaround, configure the following variables in the [server] section of the configuration file:

• Set SSH SERVER KEY EXCHANGES to curve25519-sha256, diffie-hellman-group14-sha256.
• Set SSH SERVER CIPHERS to [e-mail], aes128-ctr, aes192-ctr, aes256-ctr, [e-mail], [e-mail].
• Set SSH SERVER MACS to [e-mail], hmac-sha2-256. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-1188

CWE-327

Related Identifiers

GHSA-3M6Q-H5GJ-7MRW

Affected Products

Code.Gitea.Io/Gitea

Gitea

Gitea-Docs

Gitea-Fish-Completion

Gitea-Zsh-Completion

References · 5

• https://osv.dev/vulnerability/GHSA-3m6q-h5gj-7mrw · Vendor Advisory
• https://github.com/go-gitea/gitea · Note
• https://github.com/go-gitea/gitea/security/advisories/GHSA-3m6q-h5gj-7mrw · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-gitea-ghsa-3m6q-h5gj-7mrw-7.3 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-gitea-ghsa-3m6q-h5gj-7mrw-8.0 · Note