CVE-2026-63021: Gitea Swift package manifest memory exhaustion
Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause request failures.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has permission to publish Swift packages can exploit it. The issue is relevant to Gitea instances that allow such users to upload package archives.
What does an attacker need to upload?
The attacker needs a highly compressed archive containing many Swift package manifests. Although each individual manifest is limited to 128 KiB, the parser does not limit the number of manifests or their combined size before loading them into memory.
What impact can exploitation have?
Processing the archive can allocate substantially more memory than the archive's uploaded size. This may exhaust memory, terminate the Gitea process, or cause request failures.