Gitea repository initialization resource exhaustion
Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can submit an oversized value to amplify template reads and memory use, impairing availability.
CVE-2026-73130
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-73130
Gitea
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Gitea",
"product": "Gitea",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThanOrEqual": "1.27.2"
}
],
"packageName": "code.gitea.io/gitea",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-73130
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #22091 · Revision 1
- Added to Heist Feed
- Publisher date