Threats tagged 'ghsa-6hm7-3pwj-22rm'

Gitea versions prior to 1.27.0 contain a denial of service vulnerability in the Debian package registry parser. This flaw allows authenticated users with write access to upload malicious .deb packages that trigger excessive memory consumption through unbounded decompression. Additionally, inefficient O(N²) string concatenation in the parser causes high CPU usage, potentially stalling the server. The vulnerability can be exploited by any authenticated user with write permissions to the package registry.