Memory Exhaustion Vulnerability in Gitea's Maven Upload Handler

CVE-2026-73273

What is CVE-2026-73273?

The vulnerability in Gitea's Maven upload handler allows an authenticated user with package-publish permission to bypass package-size quotas by submitting oversized requests to the checksum endpoint. This occurs because the handler reads uploads entirely into memory and processes them without properly enforcing size limits, leading to potential server memory exhaustion. Users are advised to update to version 1.27.3 or later to mitigate this issue.

References