CVE-2026-73273: Gitea Maven checksum upload quota bypass and memory exhaustion
Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This bypasses the upload quota on that path and can exhaust server memory.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Gitea user needs package-publish permission for the affected Maven package path. Unauthenticated users are not described as able to trigger it.
What request is used to trigger the memory exhaustion?
The attacker submits an oversized request body to a Maven checksum upload endpoint. The handler reads the checksum upload fully into memory and returns before package-size quotas are enforced.
Does the normal package upload quota prevent exploitation?
No. The package-size quota is bypassed specifically on the checksum upload path because enforcement occurs after the handler has already read the body into memory.
How can defenders identify suspicious activity?
Review Maven checksum upload requests for request bodies substantially larger than a legitimate checksum, which should be no more than 128 bytes. Unexpected memory growth associated with such uploads is also indicative.