CVE-2026-62925

Deferred Deferred - Pending Action

Gitea Alpine Package Upload Memory Exhaustion

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionately large memory allocations during parsing and metadata generation. On memory-constrained deployments, this can terminate the process or otherwise disrupt availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-62925

EUVD

EUVD-2026-101082

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-62925 is a vulnerability in Gitea where authenticated users with package-publish permissions can upload small, highly compressed Alpine package files (.apk) containing excessive dependency or provision entries in the .PKGINFO file. This causes the system to allocate disproportionately large amounts of memory during parsing and metadata generation, potentially disrupting availability on memory-constrained deployments.

Detection Guidance

Monitor Gitea logs for unusual memory usage spikes during package uploads. Check for repeated uploads of small .apk files with excessive 'provides=' or 'depend=' entries in .PKGINFO. Use system monitoring tools like 'top' or 'htop' to detect processes consuming abnormal memory during Gitea operations.

Impact Analysis

An attacker could exploit this to cause a denial-of-service by consuming excessive memory, leading to process termination or system instability. This requires only low privileges and no user interaction, making it accessible to any registered user with package write access.

Compliance Impact

This vulnerability primarily impacts system availability due to memory exhaustion attacks, which could lead to service disruption. It does not directly expose or leak sensitive data, so its impact on GDPR or HIPAA compliance is likely minimal unless service unavailability affects regulated operations or data processing.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later. Restrict package-publish permissions to trusted users only. Implement size quotas for uploaded packages. Disable open registration if not required. Monitor system resources for signs of memory exhaustion.

Hi! I’m here to help you understand CVE-2026-62925. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70