CVE-2026-63021
Gitea Swift package manifest memory exhaustion
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause request failures.
| Vendor | gitea |
| Product | gitea |
| Published | Oct 14, 2026 |
| Last Updated | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for gitea gitea
Be the first to know when new medium vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Gitea / Gitea
0 ≤ 1.27.2
References
github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-fqxf-w92m-prvq blog.gitea.com: https://blog.gitea.com/release-of-1.27.3/ github.com: https://github.com/go-gitea/gitea/pull/39025 github.com: https://github.com/go-gitea/gitea/pull/39032 github.com: https://github.com/go-gitea/gitea/releases/tag/v1.27.3
Credits
🔍 https://github.com/DshtAnger https://github.com/bircni