Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐹 Go
Not in CISA KEV

GHSA-3m6q-h5gj-7mrw — gitea

GHSA-3m6q-h5gj-7mrw is a security vulnerability in code.gitea.io/gitea. A fix is available for code.gitea.io/gitea — see the affected versions and patch details below.

Gitea has insecure default SSH settings

Also known asGO-2026-5091
Published
Apr 22, 2026
Updated
Jun 25, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Jun 25, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐹code.gitea.io/gitea

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

The built-in SSH server currently advertises a number of key exchange, MAC, and host key algorithms that are considered weak or broken. The defaults should be tightened so a fresh installation passes a baseline SSH security audit out of the box.

Details

Running ssh-audit against a default deployment flags the following as fail:

  • Key exchange
    • ecdh-sha2-nistp256
    • ecdh-sha2-nistp384
    • ecdh-sha2-nistp521
  • MAC
    • hmac-sha1
  • Host key
    • ssh-rsa

Reproduction

docker run -it --rm positronsecurity/ssh-audit -p 2222 gitea.local

Impact

Default deployments expose algorithms that are known-weak or deprecated upstream. The current workaround requires manually setting several GITEA__server__SSH_SERVER_* variables, which most users will never do.

Workaround

[server]
SSH_SERVER_KEY_EXCHANGES = curve25519-sha256, diffie-hellman-group14-sha256
SSH_SERVER_CIPHERS       = [email protected], aes128-ctr, aes192-ctr, aes256-ctr, [email protected], [email protected]
SSH_SERVER_MACS          = [email protected], hmac-sha2-256

There is no exposed option to restrict host key algorithms, so ssh-rsa remains advertised.

Acceptance criteria

  • Default SSH_SERVER_KEY_EXCHANGES, SSH_SERVER_CIPHERS, and SSH_SERVER_MACS updated to the secure list above.
  • New SSH_SERVER_HOST_KEY_ALGORITHMS option added, with a default that excludes ssh-rsa.
  • Documentation updated to reflect the new defaults.
  • ssh-audit against a fresh install reports no [fail] entries.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gocode.gitea.io/giteaall versions1.25.0go get code.gitea.io/gitea@v1.25.0

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for code.gitea.io/gitea, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update code.gitea.io/gitea to 1.25.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3m6q-h5gj-7mrw is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like GHSA-3m6q-h5gj-7mrw can be triaged on real exposure rather than presence alone.

Tailored to GHSA-3m6q-h5gj-7mrw. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary The built-in SSH server currently advertises a number of key exchange, MAC, and host key algorithms that are considered weak or broken. The defaults should be tightened so a fresh installation passes a baseline SSH security audit out of the box. ## Details Running `ssh-audit` against a default deployment flags the following as `fail`: - **Key exchange** - `ecdh-sha2-nistp256` - `ecdh-sha2-nistp384` - `ecdh-sha2-nistp521` - **MAC** - `hmac-sha1` - **Host key** - `ssh-rsa` ## Reproduction ```sh docker run -it --rm positronsecurity/ssh-audit -p 2222 gitea.local ``` ##
O3 Security · Impact-Aware SCA

Is GHSA-3m6q-h5gj-7mrw in your dependencies?

O3 Security finds GHSA-3m6q-h5gj-7mrw across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.

Scan my dependencies How O3 SCA works
GHSA-3m6q-h5gj-7mrw: gitea | O3 Security