CVE-2026-117677 Details
Description
When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write access to an owner, for example their own account on an instance with open registration, could repeatedly upload small, highly compressed archives that make the server spend CPU time proportional to the decompressed size, degrading the availability of the Gitea instance. The issue does not allow code execution or data access.
A denial-of-service vulnerability has been identified in Gitea versions through 28.2.0, allowing users with package write access to cause unbounded CPU consumption on the server. This issue arises during the parsing of uploaded Helm charts, where the application decompresses the archive and reads each tar entry without limiting the decompressed size. The problem is exacerbated by the fact that the size quota only considers the compressed upload size, not the inflated bytes. As a result, a user could upload small, highly compressed archives that inflate to several gigabytes, degrading the availability of the Gitea instance. The vulnerability does not allow for code execution or unauthorized data access.
Users can upgrade to Gitea version 28.3.0, where this vulnerability has been fixed. For instructions on how to update Gitea, refer to the Gitea installation documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-28.3.0/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39942 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/40085 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v28.3.0 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-r6mh-qg79-rqj2 | Gitea Limited | AdvisoryRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | Gitea Limited |
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 28.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | Gitea Limited |