CVE-2026-56755: Gitea DoS via resource exhaustion in Debian package upload

Executive brief

Gitea, a popular self-hosted Git service, is vulnerable to a denial-of-service attack through its Debian package registry. An authenticated user can upload a specially crafted package file that causes the server to exhaust its memory and CPU resources. This can lead to the entire Gitea service becoming unresponsive or crashing, disrupting operations for all users.

Technical details

Gitea's Debian package registry parser contains two resource exhaustion vulnerabilities. First, the 'ParseControlFile' function lacks an 'io.LimitReader', allowing an 'unbounded decompression' (decompression bomb) where a small compressed '.deb' file expands to gigabytes in memory via a 'TeeReader' and 'strings.Builder'. Second, the parser uses inefficient 'O(N²)' string concatenation ('+=') when processing continuation lines in the 'Description' field. An authenticated attacker with write access to the package registry can exploit these by uploading a crafted '.deb' file, causing the server to hit Out-Of-Memory (OOM) limits or saturate CPU cores. The issue is fixed in version 1.27.0.

Affected products

• Gitea Gitea < 1.27.0

Timeline

• 2026-07-13: disclosed
• 2026-07-21: advisory

References

• https://api.github.com/users/AdamKorcz
• https://github.com/AdamKorcz
• https://api.github.com/users/AdamKorcz/gists%7B/gist_id%7D
• https://api.github.com/users/AdamKorcz/repos
• https://avatars.githubusercontent.com/u/44787359?v=4
• https://api.github.com/users/AdamKorcz/events%7B/privacy%7D