Vulnerability · Published Oct 14, 2026 · Assigned by Gitea

CVE-2026-63021Gitea Swift package manifest memory exhaustion

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 53.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause request failures.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – through 1.27.2

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory GHSA-fqxf-w92m-prvq vendor-advisory
Gitea 1.27.3 release announcement release-notes
Fix: go-gitea/gitea pull request #39025 patch
Fix: go-gitea/gitea pull request #39032 patch
go-gitea/gitea v1.27.3 release release-notes