# CVE-2021-3382: GO-2024-2757 - Buffer Overflow in gitea in code.gitea.io/gitea

Source: https://junglewise.ai/threats/cve-2021-3382-buffer-overflow-in-gitea  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-06-04  
License: CC BY 4.0 with a link back

CVE-2021-3382 · Severity: low · CVSS 3.1 · Published 2024-06-04

Buffer Overflow in gitea in code.gitea.io/gitea

Technologies: [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea), [github.com/go-gitea/gitea (Go)](https://junglewise.ai/threats/technologies/github-com-go-gitea-gitea). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2021-3382 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-3382 being exploited in the wild.

**How severe is CVE-2021-3382?** Low severity, with a CVSS score of 3.1, published 4 June 2024.

**Which products and versions are affected?** code.gitea.io/gitea (Go) SEMVER:introduced=1.9.0,fixed=1.13.2; github.com/go-gitea/gitea (Go) SEMVER:introduced=1.9.0,fixed=1.13.2.

**Is there a fix for CVE-2021-3382?** Yes. code.gitea.io/gitea (Go): upgrade to 1.13.2 or later; github.com/go-gitea/gitea (Go): upgrade to 1.13.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2021-3382?** Check whether you run code.gitea.io/gitea (Go) or github.com/go-gitea/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code.gitea.io/gitea (Go): upgrade to 1.13.2 or later

  ```sh
  go get code.gitea.io/gitea@v1.13.2
  ```

- github.com/go-gitea/gitea (Go): upgrade to 1.13.2 or later

  ```sh
  go get github.com/go-gitea/gitea@v1.13.2
  ```


## Affected products

- code.gitea.io/gitea (Go) SEMVER:introduced=1.9.0,fixed=1.13.2
- github.com/go-gitea/gitea (Go) SEMVER:introduced=1.9.0,fixed=1.13.2

## Identifiers

- CVE-2021-3382
- GHSA-9f8c-pfvv-p4gm
- GO-2024-2757

## Related threats

- [Gitea incorrect authorization in starred repos and tracked times API](https://junglewise.ai/threats/cve-2026-59766-gitea-incorrect-authorization-in-starred-repos-and-tracked-times)
- [Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.](https://junglewise.ai/threats/cve-2026-60004-gitea-code-injection-in-diffpatch-api)
- [SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata](https://junglewise.ai/threats/cve-2026-59765-gitea-ssrf-and-local-file-read-via-migration-asset-bypass)
- [Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads](https://junglewise.ai/threats/cve-2026-59763-gitea-resource-amplification-in-arch-package-metadata-parsing)
- [Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata](https://junglewise.ai/threats/cve-2026-34966-gitea-ssrf-via-migration-asset-downloads-bypasses-hostmatcher)