CVE-2026-73130
Gitea repository initialization resource exhaustion
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can submit an oversized value to amplify template reads and memory use, impairing availability.
| CWE | CWE-400 |
| Vendor | gitea |
| Product | gitea |
| Published | Oct 14, 2026 |
| Last Updated | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for gitea gitea
Be the first to know when new medium vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Gitea / Gitea
0 ≤ 1.27.2
References
github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-8r3w-5682-jrqf blog.gitea.com: https://blog.gitea.com/release-of-1.27.3/ github.com: https://github.com/go-gitea/gitea/pull/39027 github.com: https://github.com/go-gitea/gitea/pull/39040 github.com: https://github.com/go-gitea/gitea/releases/tag/v1.27.3
Credits
🔍 https://github.com/arpitjain099 https://github.com/bircni https://github.com/wxiaoguang