All vulnerabilities
CVE-2026-63021GHSA-fqxf-w92m-prvq

Gitea Swift package manifest memory exhaustion

Gitea Gitea
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.55%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.27.3Fixed versionGitHub
Published14 Oct 2026Updated 14 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause request failures.

Text from CVE List

Affected versions 2

  • Giteaaffected: all versions through 1.27.2CVE List
  • gitea<= 1.27.2GitHub

References 5