Vulnerability · Published Nov 1, 2026 · Assigned by Gitea

CVE-2026-117677Gitea Helm chart upload decompression denial of service

Unrated

In plain English

A uncontrolled resource consumption in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS )–Not rated

Exploit odds (30 days)0.2%top 88.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write access to an owner, for example their own account on an instance with open registration, could repeatedly upload small, highly compressed archives that make the server spend CPU time proportional to the decompressed size, degrading the availability of the Gitea instance. The issue does not allow code execution or data access.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – before 28.3.0

Weakness: CWE-400, CWE-409

References

GitHub Security Advisory GHSA-r6mh-qg79-rqj2 vendor-advisory
Fix: go-gitea/gitea pull request #39942 patch
Fix backport to release/v28: go-gitea/gitea pull request #40085 patch
Gitea 28.3.0 release announcement release-notes
go-gitea/gitea v28.3.0 release release-notes