Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads (CVE-2026-59763)
Gitea versions prior to 1.27.0 contain a vulnerability in the Arch package registry implementation where authenticated users with package publishing permissions can upload Arch package archives with an unbounded number of file entries. This causes resource amplification, leading to excessive consumption of CPU, memory, database storage, and repository index generation resources. The vulnerability impacts availability but does not affect confidentiality or integrity. A patch is available to address this issue.
AI Analysis
Technical Summary
The vulnerability in Gitea's Arch package registry allows authenticated users with publishing rights to upload Arch package archives containing an unlimited number of file entries. This results in resource amplification where small compressed archives generate disproportionately large server-side metadata. The amplified resource usage affects CPU, memory, database storage, and repository index generation, potentially degrading service availability. The issue is tracked as CVE-2026-59763 and affects all Gitea versions prior to 1.27.0. The vulnerability does not compromise confidentiality or integrity. A fix has been made available in version 1.27.0.
Potential Impact
This vulnerability can degrade the availability of Gitea services by causing excessive resource consumption on the server side. It does not impact the confidentiality or integrity of data. The resource amplification can lead to performance degradation or denial of service conditions due to high CPU, memory, and storage usage during package upload processing.
Mitigation Recommendations
A patch is available in Gitea version 1.27.0 that addresses this vulnerability. Users should upgrade to version 1.27.0 or later to mitigate the risk. No additional mitigation actions are required if the system is updated.
Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads (CVE-2026-59763)
Description
Gitea versions prior to 1.27.0 contain a vulnerability in the Arch package registry implementation where authenticated users with package publishing permissions can upload Arch package archives with an unbounded number of file entries. This causes resource amplification, leading to excessive consumption of CPU, memory, database storage, and repository index generation resources. The vulnerability impacts availability but does not affect confidentiality or integrity. A patch is available to address this issue.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Gitea's Arch package registry allows authenticated users with publishing rights to upload Arch package archives containing an unlimited number of file entries. This results in resource amplification where small compressed archives generate disproportionately large server-side metadata. The amplified resource usage affects CPU, memory, database storage, and repository index generation, potentially degrading service availability. The issue is tracked as CVE-2026-59763 and affects all Gitea versions prior to 1.27.0. The vulnerability does not compromise confidentiality or integrity. A fix has been made available in version 1.27.0.
Potential Impact
This vulnerability can degrade the availability of Gitea services by causing excessive resource consumption on the server side. It does not impact the confidentiality or integrity of data. The resource amplification can lead to performance degradation or denial of service conditions due to high CPU, memory, and storage usage during package upload processing.
Mitigation Recommendations
A patch is available in Gitea version 1.27.0 that addresses this vulnerability. Users should upgrade to version 1.27.0 or later to mitigate the risk. No additional mitigation actions are required if the system is updated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-9mq6-mqjj-c2c5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59763"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a600abb9c2644c7f8fe2ba4
Added to database: 07/22/2026, 00:11:39 UTC
Last enriched: 08/14/2026, 12:55:49 UTC
Last updated: 09/13/2026, 22:01:35 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.