Executive brief
Gitea is an open-source platform for hosting software development projects. A vulnerability in its Arch Linux package registry allows authenticated users to upload specially crafted packages that cause the server to consume excessive resources. This can lead to significant slowdowns, increased database storage costs, and potential service outages for the entire Gitea instance.
Technical details
The vulnerability exists in Gitea's Arch package registry implementation where the server fails to limit the number of file entries or the cumulative size of file names recorded from an uploaded Arch package archive (.pkg.tar.gz). During the upload flow, `modules/packages/arch/metadata.go` appends every regular file entry to the package metadata, which is then serialized as JSON and stored in the database. An attacker with package publishing permissions can upload a small, highly compressed archive containing hundreds of thousands of empty files. This results in resource amplification during metadata parsing, database persistence, and subsequent repository index generation, leading to excessive CPU, memory, and storage consumption. The issue is fixed in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: disclosed
- 2026-07-13: advisory
- 2026-07-21: patched: Date of GHSA publication indicates patch availability in 1.27.0