Is CVE-2026-42931 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42931 being exploited in the wild.

How severe is CVE-2026-42931?

Medium severity, with a CVSS score of 6.5, published 21 July 2026.

Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Is there a fix for CVE-2026-42931?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42931 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42931?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42931: Gitea denial of service via unbounded memory allocation in NPM API

Q: Which products and versions are affected?

Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.

Q: Is there a fix for CVE-2026-42931?

Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-42931 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-42931?

Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42931 · Severity: medium · CVSS 6.5 · Published 2026-07-21

Gitea, a popular self-hosted software development platform, is vulnerable to a denial-of-service attack. An authenticated user can crash the entire server by sending a single, specially crafted large request to the NPM package registry component. This can lead to a complete outage of the service, affecting all users' access to code repositories and development tools, and can be repeated to keep the server offline even after it restarts.

Technologies: Gitea, code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-42931 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42931 being exploited in the wild.
How severe is CVE-2026-42931?: Medium severity, with a CVSS score of 6.5, published 21 July 2026.
Which products and versions are affected?: Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0, SEMVER:introduced=0,fixed=1.27.0; gitea.dev (Go) SEMVER:introduced=0,fixed=1.27.0.
Is there a fix for CVE-2026-42931?: Yes. code.gitea.io/gitea (Go): upgrade to 1.27.0 or later; gitea.dev (Go): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42931 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42931?: Check whether you run Gitea, code.gitea.io/gitea (Go) or gitea.dev (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

code.gitea.io/gitea (Go): upgrade to 1.27.0 or later
```
go get code.gitea.io/gitea@v1.27.0
```
gitea.dev (Go): upgrade to 1.27.0 or later
```
go get gitea.dev@v1.27.0
```

Technical details

The vulnerability exists in the `AddPackageTag` function within `routers/api/packages/npm/npm.go`. The application uses `io.ReadAll(ctx.Req.Body)` to read the entire HTTP request body into memory without any size validation or limits. Because Go's `io.ReadAll` dynamically grows the backing byte slice, a sufficiently large request causes the Go runtime to throw an unrecoverable 'out of memory' error, killing the entire process. This endpoint bypasses Gitea's standard package size limits and buffer protections. An attacker requires network access and valid authentication (which can be obtained via self-registration if enabled) to exploit this flaw. The issue is fixed in Gitea version 1.27.0.

Affected products

Gitea Gitea < 1.27.0

Identifiers

CVE-2026-42931
GHSA-wwqq-x6w4-frm2
GO-2026-6082

Timeline

2026-07-13: advisory: Initial GitHub Advisory published
2026-07-21: patched: Gitea v1.27.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.