CVE-2026-62925 — Gitea Alpine package parsing memory exhaustion
Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authen…
Published: 2026-10-14 · CVSS: 6.5 · CVSS 3.1
Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionately large memory allocations during parsing and metadata generation. On memory-constrained deployments, this can terminate the process or otherwise disrupt availability.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7