Gitea's Arch package upload endpoint parses uploaded Arch package archives and records non-dot regular file entries into package metadata without explicit limits on the number or cumulative size of these entries. This metadata is serialized, stored, and used during repository index generation. An authenticated user with package publishing permission can exploit this by uploading an archive with a large number of empty file entries, causing significant resource amplification on the server side. Testing showed that a 470 KB archive with 100,000 empty files generated over 4.5 MB of metadata, and a 2.3 MB archive with 500,000 empty files generated over 22.5 MB of metadata. This impacts CPU, memory, database storage, and index generation time, potentially affecting availability.

The vulnerability allows an authenticated user with package publishing permissions to cause resource amplification by uploading Arch packages with excessive file entries. This can lead to increased CPU and memory usage during metadata parsing and repository index generation, larger database storage requirements for serialized metadata, and slower repository index processing. The impact is limited to availability degradation; confidentiality and integrity are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict package publishing permissions to trusted users only to reduce the risk of exploitation. Monitor resource usage related to package uploads and consider implementing custom limits or validations on the number of file entries in Arch packages if possible.