Gitea versions prior to 1.27.0 contain a vulnerability in the Arch package registry implementation where authenticated users with package publishing permissions can upload Arch package archives with an unbounded number of file entries. This causes resource amplification, leading to excessive consumption of CPU, memory, database storage, and repository index generation resources. The vulnerability impacts availability but does not affect confidentiality or integrity. A patch is available to address this issue.