Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload (CVE-2026-56755)
Gitea versions prior to 1.27.0 contain a denial of service vulnerability in the Debian package registry parser. This flaw allows authenticated users with write access to upload malicious .deb packages that trigger excessive memory consumption through unbounded decompression. Additionally, inefficient O(N²) string concatenation in the parser causes high CPU usage, potentially stalling the server. The vulnerability can be exploited by any authenticated user with write permissions to the package registry.
AI Analysis
Technical Summary
Gitea before version 1.27.0 has a denial of service vulnerability (CVE-2026-56755) in its Debian package registry parser. The issue arises from two main factors: unbounded decompression of uploaded .deb files, which can be crafted to expand and consume excessive memory, and inefficient O(N²) string concatenation when processing continuation lines in the Description field, leading to high CPU usage. An authenticated user with write access to the package registry can exploit this by uploading a malicious package, causing the server to stall or exhaust resources.
Potential Impact
Successful exploitation results in denial of service due to CPU and memory exhaustion on the Gitea server. This can degrade or halt service availability for legitimate users. The vulnerability requires authenticated write access to the package registry, limiting exposure to authorized users.
Mitigation Recommendations
A patch is available for this vulnerability in Gitea version 1.27.0 and later. Users should upgrade to version 1.27.0 or newer to remediate this issue. Since this is not a cloud service, administrators must apply the update themselves to mitigate the risk.
Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload (CVE-2026-56755)
Description
Gitea versions prior to 1.27.0 contain a denial of service vulnerability in the Debian package registry parser. This flaw allows authenticated users with write access to upload malicious .deb packages that trigger excessive memory consumption through unbounded decompression. Additionally, inefficient O(N²) string concatenation in the parser causes high CPU usage, potentially stalling the server. The vulnerability can be exploited by any authenticated user with write permissions to the package registry.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Gitea before version 1.27.0 has a denial of service vulnerability (CVE-2026-56755) in its Debian package registry parser. The issue arises from two main factors: unbounded decompression of uploaded .deb files, which can be crafted to expand and consume excessive memory, and inefficient O(N²) string concatenation when processing continuation lines in the Description field, leading to high CPU usage. An authenticated user with write access to the package registry can exploit this by uploading a malicious package, causing the server to stall or exhaust resources.
Potential Impact
Successful exploitation results in denial of service due to CPU and memory exhaustion on the Gitea server. This can degrade or halt service availability for legitimate users. The vulnerability requires authenticated write access to the package registry, limiting exposure to authorized users.
Mitigation Recommendations
A patch is available for this vulnerability in Gitea version 1.27.0 and later. Users should upgrade to version 1.27.0 or newer to remediate this issue. Since this is not a cloud service, administrators must apply the update themselves to mitigate the risk.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6hm7-3pwj-22rm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-56755"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a600abb9c2644c7f8fe2b7d
Added to database: 07/22/2026, 00:11:39 UTC
Last enriched: 08/14/2026, 12:55:14 UTC
Last updated: 09/15/2026, 01:43:40 UTC
Views: 47
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.