Denial of Service in NPM Package Tag Endpoint

Executive Summary

CVE-2026-42931 is a Denial of Service vulnerability in Gitea software affecting versions up to 1.27.0-dev. It involves an unbounded io.ReadAll call in the NPM package tag API endpoint that reads the entire HTTP request body into memory without size limits. This causes an Out-of-Memory condition, crashing the server when the request exceeds approximately 80% of available memory.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusually large HTTP requests targeting the NPM package tag API endpoint. Check server logs for requests with large payloads exceeding typical sizes. Use network monitoring tools to detect repeated large requests from authenticated users.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows any authenticated user with write access to crash the Gitea server by sending a single large HTTP request. The attack requires minimal bandwidth and can be repeated after server restarts. It disrupts service availability and may lead to data loss or extended downtime if not mitigated.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to Gitea version 1.27.0 or later which includes fixes. Disable the package registry if not needed. Implement request size limits on the web server or reverse proxy. Restrict write access to package namespaces to only necessary users.

Useful 0 Not Useful 0