CVE-2026-73130 in Gitea
Summary
by MITRE • 10/14/2026
Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can submit an oversized value to amplify template reads and memory use, impairing availability.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Gitea represents a significant resource exhaustion flaw rooted in inadequate input validation within the repository creation workflow. Specifically, the system fails to enforce length constraints on the gitignores field accepted by both the web-based repository-creation forms and the associated application programming interface. This oversight allows an authenticated attacker with permission to create repositories to submit excessively large values for this parameter. The core technical flaw lies in how Gitea processes this input during initialization; rather than validating or truncating the data, the system proceeds to split the provided string into individual template names. It then iteratively reads each referenced .gitignore template file and buffers their entire contents directly into memory without any size limitations or safeguards against excessive accumulation.
This mechanism creates a direct path for an availability-focused attack where malicious actors can trigger disproportionate resource consumption relative to the effort required. By submitting a crafted payload containing numerous references to large files or simply repeating small templates many times, an attacker can cause Gitea to allocate substantial amounts of server memory and CPU cycles during repository initialization. This unbounded buffering effectively amplifies the impact of the input, leading to rapid degradation of system performance for all users sharing the instance. In severe cases, this resource exhaustion can lead to service crashes or complete denial of service conditions, rendering the platform inaccessible until resources are recovered or services restarted.
From a classification perspective, this vulnerability aligns with CWE-787 Out-of-bounds Write in terms of memory allocation risks and more accurately reflects CWE-400 Uncontrolled Resource Consumption due to the failure to limit resource usage based on user input. In the context of attack tactics, it maps directly to ATT&CK technique T1496 Resource Hijacking, specifically under sub-techniques involving denial-of-service through resource exhaustion. The vulnerability exploits the trust placed in authenticated users and relies on the application's internal logic for template resolution rather than external network vectors, highlighting a critical gap in input sanitization protocols within development tools that handle file system operations.
Mitigation strategies must focus on implementing strict validation rules at both the API layer and the web form processing stage. Developers should enforce maximum length limits on the gitignores field to prevent excessively large payloads from entering the initialization pipeline. Additionally, it is crucial to implement safeguards against recursive or repetitive template loading that could lead to memory bloat. This includes setting hard caps on the total size of buffered content during repository creation and potentially introducing timeouts for file read operations. Regular security audits focusing on input validation in configuration-heavy fields are essential to prevent similar resource exhaustion vulnerabilities in future updates, ensuring that the platform remains resilient against abuse by authenticated users seeking to disrupt service availability.