The vulnerability in Gitea's Debian package registry parser involves two main issues. First, the parser decompresses the control.tar.gz file from an uploaded .deb package without limiting the decompressed data size, enabling a decompression bomb attack that can exhaust server memory by expanding a small compressed payload into a very large uncompressed stream. Second, the parser concatenates continuation lines in the Description field using repeated string addition (+=), which is an O(N²) operation in Go due to string immutability. This causes excessive CPU consumption and garbage collection overhead, leading to service stalls. Both issues can be exploited independently or together by any authenticated user with write permissions to the package registry, resulting in a complete denial of service.

An attacker with authenticated write access to the Gitea package registry can upload a specially crafted Debian package that causes the server to consume excessive memory and CPU resources during parsing. This leads to denial of service by exhausting server memory (via unbounded decompression) and stalling the CPU (via inefficient string concatenation). The service becomes unresponsive, impacting availability. There is no indication of code execution or data leakage from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access to the Debian package registry to trusted users only. Monitor for unusually large or suspicious package uploads and consider implementing external resource limits on decompression size and CPU usage if possible. Avoid processing untrusted .deb packages in vulnerable Gitea versions.