CVE-2026-117677
Deferred Deferred - Pending Action

Denial of Service in Gitea via Malicious Helm Chart

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Gitea Limited

Description
When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write access to an owner, for example their own account on an instance with open registration, could repeatedly upload small, highly compressed archives that make the server spend CPU time proportional to the decompressed size, degrading the availability of the Gitea instance. The issue does not allow code execution or data access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-117677

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Gitea allows an authenticated user with package-write access to cause a denial-of-service (DoS) by uploading a specially crafted Helm chart. The issue occurs because Gitea decompresses and processes the entire Helm chart archive before checking package-size quotas, consuming excessive CPU proportional to the decompressed size while the quota only checks the compressed size.

Detection Guidance

Monitor for unusual CPU usage spikes during Helm chart uploads. Check Gitea logs for repeated failed or slow package upload attempts. Use system monitoring tools like top, htop, or sar to detect abnormal CPU consumption by the Gitea process.

Impact Analysis

This vulnerability can degrade the availability of the Gitea instance by consuming excessive CPU resources. It does not allow code execution or data access but can disrupt service for other users, especially if the instance has open registration or unlimited Helm package size limits.

Compliance Impact

This vulnerability primarily causes a denial-of-service (DoS) condition by consuming excessive CPU resources, which could impact the availability of Gitea services. It does not directly affect data confidentiality or integrity, nor does it allow unauthorized code execution or data access. For compliance standards like GDPR or HIPAA, which emphasize data protection and service availability, the main concern would be potential disruptions to service availability due to resource exhaustion.

Mitigation Strategies

Restrict Helm chart publishing to trusted users only. Set strict package size quotas for Helm charts. Disable open registration if not required. Update Gitea to the latest version once a patch is released. Monitor network traffic for suspicious upload patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117677. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...