Resource Depletion Vulnerability in Gitea for Helm Chart Parsing
CVE-2026-117677

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
1 November 2026

What is CVE-2026-117677?

A resource depletion vulnerability in Gitea allows a user with package write access to repeatedly upload small, highly compressed Helm chart archives. The server spends CPU resources proportional to the decompressed size without adequately verifying limits on decompressed data size, impacting the availability of the Gitea instance. This issue arises because the package size quota only considers the compressed upload size, not the potential CPU workload from decompression.

Affected Version(s)

Gitea 0 < 28.3.0

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/39942
patch
https://github.com/go-gitea/gitea/pull/40085
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/skeletonsec
https://github.com/jisung-02
https://github.com/kewmine
https://github.com/bircni
.