CVE-2026-63021
mediumGitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory.
Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause request failures.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://blog.gitea.com/release-of-1.27.3/ 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/pull/39025 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/pull/39032 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/releases/tag/v1.27.3 88ee5874-cf24-4952-aea0-31affedb7ff2
- https://github.com/go-gitea/gitea/security/advisories/GHSA-fqxf-w92m-prvq 88ee5874-cf24-4952-aea0-31affedb7ff2