Memory Allocation Vulnerability in Gitea Affects Package Upload Handling
CVE-2026-62925

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-62925?

Gitea processes Alpine package uploads without adequately enforcing package size limits. This oversight allows authenticated users with package-publish permissions to exploit the system by uploading highly compressed archives. Consequently, unbounded decompression of .PKGINFO data can lead to excessive memory consumption, particularly in memory-constrained environments, ultimately risking process termination and service availability.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39026
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/DshtAnger
https://github.com/bircni
.