Memory Exhaustion Vulnerability in Gitea's Package Parsing Functionality
CVE-2026-63021

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-63021?

Gitea's Swift package parser has a limitation of 128 KiB per manifest but lacks restrictions on the total number of manifests or their cumulative size when processed. This oversight enables authenticated users with package-publish rights to upload oversized, compressed archives containing numerous manifests. This could lead to memory exhaustion, potentially crashing the application or causing significant request failures as the system attempts to handle requests exceeding its memory capacity.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39025
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/DshtAnger
https://github.com/bircni
.