CVE-2026-73130 Details

A denial-of-service vulnerability has been identified in Gitea versions through 1.27.2. The issue arises because the repository-creation form and API do not impose a limit on the length of the 'gitignores' field. This lack of restriction allows an attacker to submit excessively long values, which are then processed during repository initialization. The field is split into template names, and each name triggers a read of the corresponding template, with the contents buffered in memory. As a result, an attacker can exploit this vulnerability to amplify template reads and increase memory usage, thereby impairing the application's availability.

Users can upgrade to Gitea version 1.27.3, which addresses this vulnerability by introducing a length limit on the 'gitignores' field in both the web form and the API. Instructions for upgrading are available in the Gitea documentation.