CVE-2026-63021 Details
Description
Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause request failures.
A denial-of-service vulnerability has been identified in Gitea's Swift package parser, present in versions through 1.27.2. The issue arises because the parser imposes a per-file size limit of 128 KiB on package manifests but fails to restrict the total number of manifests or their cumulative size before processing them. This allows authenticated users with package-publish permissions to upload small, highly compressed archives containing numerous manifests. The resulting memory allocation can significantly exceed the original archive size, potentially exhausting system resources and causing the Gitea process to be terminated or leading to request failures.
Users can upgrade to Gitea version 1.27.3, which addresses this vulnerability by implementing a cap on the aggregate size of uploaded Swift package manifests. For those using Gitea Cloud, the update will be applied automatically.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-1.27.3/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39025 | Gitea Limited | Source CodeVendor |
| https://github.com/go-gitea/gitea/pull/39032 | Gitea Limited | Source CodeVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.3 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-fqxf-w92m-prvq | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 1.27.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | Gitea Limited |