Memory Allocation Vulnerability in Gitea Repository Creation Process
CVE-2026-73130

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-73130?

Gitea's repository creation forms and API lack a proper limit on the length of the gitignore field. This oversight allows an attacker with repository creation permissions to submit a excessively long input, which can lead to amplified reads of template files. This process exhaustively allocates memory by buffering the contents of these templates, potentially causing denial of service. Users are advised to remain vigilant and implement the latest updates from Gitea to mitigate the impact of this vulnerability.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39027
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/arpitjain099
https://github.com/bircni
https://github.com/wxiaoguang
.