CVE-2026-62925: Gitea Alpine package parsing memory exhaustion
Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionately large memory allocations during parsing and metadata generation. On memory-constrained deployments, this can terminate the process or otherwise disrupt availability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must have permission to publish Alpine packages. The impact is most significant on memory-constrained Gitea deployments, where excessive allocations can terminate the process or disrupt availability.
What type of upload triggers the problem?
The attacker can submit a small, highly compressed Alpine package archive whose decompressed .PKGINFO content, dependency data, or provides entries are disproportionately large. Parsing and metadata generation can allocate memory before package-size quotas are enforced.