CVE-2026-42931: Gitea denial of service via unbounded memory allocation in NPM API

Executive brief

Gitea, a popular self-hosted software development platform, is vulnerable to a denial-of-service attack. An authenticated user can crash the entire server by sending a single, specially crafted large request to the NPM package registry component. This can lead to a complete outage of the service, affecting all users' access to code repositories and development tools, and can be repeated to keep the server offline even after it restarts.

Technical details

The vulnerability exists in the `AddPackageTag` function within `routers/api/packages/npm/npm.go`. The application uses `io.ReadAll(ctx.Req.Body)` to read the entire HTTP request body into memory without any size validation or limits. Because Go's `io.ReadAll` dynamically grows the backing byte slice, a sufficiently large request causes the Go runtime to throw an unrecoverable 'out of memory' error, killing the entire process. This endpoint bypasses Gitea's standard package size limits and buffer protections. An attacker requires network access and valid authentication (which can be obtained via self-registration if enabled) to exploit this flaw. The issue is fixed in Gitea version 1.27.0.

Affected products

• Gitea Gitea < 1.27.0

Timeline

• 2026-07-13: advisory: Initial GitHub Advisory published
• 2026-07-21: patched: Gitea v1.27.0 released

References

• https://api.github.com/users/Tricta
• https://github.com/Tricta
• https://api.github.com/users/Tricta/gists%7B/gist_id%7D
• https://api.github.com/users/Tricta/repos
• https://avatars.githubusercontent.com/u/76655731?v=4
• https://api.github.com/users/Tricta/events%7B/privacy%7D