CVE-2026-73130

Deferred Deferred - Pending Action

Gitea Repository Creation Memory Amplification

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can submit an oversized value to amplify template reads and memory use, impairing availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-73130

EUVD

EUVD-2026-101101

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

CVE-2026-73130 is a vulnerability in Gitea where the gitignores field during repository creation had no size limit. An attacker could submit an oversized value, causing the system to repeatedly read template files and buffer their contents in memory. This leads to resource exhaustion and potential denial of service.

Detection Guidance

Check Gitea version with: curl -s http://your-gitea-server/api/version | grep version. If version is 1.27.2 or earlier, the system is vulnerable. Monitor for unusual memory usage spikes during repository creation.

Impact Analysis

This vulnerability allows an attacker with repository creation privileges to consume excessive memory and system resources. This can degrade performance, cause system unresponsiveness, or lead to a denial of service, impacting availability for all users.

Compliance Impact

This vulnerability primarily impacts availability by causing resource exhaustion through memory amplification during repository creation. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged unavailability of Gitea instances could indirectly impact compliance by disrupting access to regulated data or audit logs.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. No other workarounds are available. Ensure automatic updates are enabled or schedule manual upgrades during maintenance windows.

Hi! I’m here to help you understand CVE-2026-73130. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70