CVE-2026-73273 Details

A vulnerability in Gitea's Maven upload handler allows authenticated users with package-publish permission to bypass package-size quotas and cause excessive memory usage on the server. This occurs because the upload handler reads checksum files completely into memory before enforcing size limits. While legitimate checksum values are at most 128 bytes, an oversized body can be submitted to the checksum endpoint, exploiting this oversight and potentially leading to a denial-of-service condition.

Users can upgrade to Gitea version 1.27.3, which addresses this vulnerability. Instructions for upgrading are available in the Gitea documentation.