CVE-2026-42931
Description
A flaw was found in Gitea. An authenticated attacker can trigger a denial of service by sending a large HTTP request to the NPM package tag API endpoint. The server attempts to read the entire request body into memory without a size limit, leading to an Out-of-Memory (OOM) error and crashing the Gitea instance. This can result in a persistent denial of service, making all hosted services unavailable to users.
Statement
A flaw was found in Gitea. An authenticated attacker can trigger a denial of service by sending a large HTTP request to the NPM package tag API endpoint. The server reads the entire request body into memory without a size limit, leading to an Out-of-Memory (OOM) crash. Red Hat products that bundle code.gitea.io/gitea as a Go dependency are affected by this vulnerability.
Mitigation
If a reverse proxy (e.g., nginx, HAProxy) sits in front of the Gitea-bundling application, configure a maximum client request body size (e.g., client_max_body_size 100m in nginx) to limit the data that can reach the vulnerable endpoint. This does not fully remediate the issue but reduces the attack surface.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
