Vulnerability · Published Oct 14, 2026 · Assigned by Gitea

CVE-2026-73273Gitea Maven checksum upload quota bypass and memory exhaustion

Medium 4.3

In plain English

A medium-severity resource allocation without limits in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 66.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This bypasses the upload quota on that path and can exhaust server memory.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	0 – through 1.27.2

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

GitHub Security Advisory GHSA-5xcq-p92v-43rf vendor-advisory
Gitea 1.27.3 release announcement release-notes
Fix: go-gitea/gitea pull request #39028 patch
Fix: go-gitea/gitea pull request #39031 patch
go-gitea/gitea v1.27.3 release release-notes