The vulnerability (CVE-2026-42931) in Gitea's NPM package tag API endpoint arises from the use of io.ReadAll(ctx.Req.Body) without any size validation, allowing an authenticated user to send an arbitrarily large HTTP request body. This causes the Go runtime to attempt to allocate excessive memory, leading to an out-of-memory runtime panic that kills the entire Gitea process. The endpoint requires write access to the user's own package namespace but does not require the package to exist. Existing package size limits are not enforced on this endpoint, and the memory-buffering protections used elsewhere in Gitea are bypassed. The issue affects all Gitea versions before 1.27.0. No official patch or fix is currently documented.

Successful exploitation results in a denial of service condition by crashing the Gitea server process due to out-of-memory errors. This can be triggered by a single large HTTP request to the NPM package tag endpoint by any authenticated user with write access to their package namespace. The denial of service is persistent and can survive automatic server restarts, impacting availability of the Gitea service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting access to the NPM package tag API endpoint to trusted users only or implementing external request size limits at the network or proxy level to prevent large request bodies. Monitoring for unusual request sizes targeting this endpoint may also help detect exploitation attempts.