CVE-2026-59763
Received Received - Intake

Resource Amplification in Gitea Package Uploads

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-59763
EUVD
EUVD-2026-58125

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
gitea gitea to 1.26.4 (inc)
go-gitea gitea to 1.26.4 (inc)
go-gitea gitea 1.27.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59763 is a resource amplification vulnerability in Gitea's Arch package registry. An authenticated user with package publishing rights can upload a specially crafted Arch package containing many empty file entries. Gitea processes these entries into package metadata without size or count limits, causing excessive server resource usage during parsing, storage, and index generation.

Detection Guidance

Check Gitea logs for unusually large package metadata files or repository index files. Monitor for high CPU or memory usage during package uploads or metadata processing. Inspect uploaded Arch packages for excessive file entries using commands like 'tar -tvf package.tar.gz' to list contents.

Impact Analysis

This vulnerability can lead to server slowdowns or crashes due to high CPU and memory usage. It may disrupt service availability for all users. Attackers could exploit it to degrade system performance even if upload size limits are not exceeded.

Mitigation Strategies

Upgrade Gitea to version 1.27.0 or later to apply the patch. Restrict package upload permissions to trusted users only. Monitor and limit the size of uploaded packages. Review and remove any suspicious large package files from the registry.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59763. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart