CVE-2026-73273 in Gitea
Summary
by MITRE • 10/14/2026
Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This bypasses the upload quota on that path and can exhaust server memory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in Gitea represents a critical resource exhaustion flaw within its Maven package management subsystem, specifically targeting the artifact upload handler responsible for processing checksum files. In standard software development workflows using Apache Maven, developers frequently deploy artifacts to private or public repositories hosted on platforms like Gitea. The platform implements security controls such as storage quotas and size limits to prevent abuse and ensure system stability. However, a logical error in the request handling sequence allows an authenticated user with package-publish permissions to bypass these protective measures by exploiting the specific endpoint used for uploading checksum files rather than the main artifact file itself.
Technically, the flaw stems from how Gitea processes incoming HTTP requests for Maven uploads. When a client submits a package upload, the system is designed to enforce strict size quotas on the total payload to prevent disk space exhaustion or denial of service attacks. The vulnerability arises because the handler responsible for processing checksum files reads the entire request body into server memory before performing any validation checks regarding file size limits. While legitimate Maven checksums are typically small, consisting primarily of hexadecimal strings that rarely exceed 128 bytes in length, an attacker can craft a malicious HTTP POST request with a significantly larger payload to this specific endpoint. Because the system allocates memory for the full body content prior to checking whether it exceeds the configured quota, the size restriction is effectively circumvented on this path.
The operational impact of this vulnerability is severe, primarily centering on Denial of Service (DoS) through resource exhaustion. Since each malicious request causes the server to allocate a large amount of RAM proportional to the uploaded payload, an attacker can repeatedly send oversized checksum uploads to deplete available memory resources rapidly. This leads to increased latency for legitimate users, potential crashes of the Gitea application process if swap space is exhausted, and ultimately renders the repository service unavailable. Unlike attacks that target disk storage, this vulnerability targets volatile memory, making it particularly dangerous in environments where rapid request rates can quickly overwhelm system limits without leaving persistent traces on the file system.
From a classification perspective, this issue aligns with CWE-787: Out-of-bounds Read and CWE-400: Uncontrolled Resource Consumption. The failure to validate input size before resource allocation is a classic example of improper check for unusual or unexpected input leading to resource exhaustion. In the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Impact categories, specifically Denial of Service via service interruption (T1499) and potentially Resource Hijacking if the memory consumption impacts other co-located services on the same host. The attack vector is classified as Network-based but requires authentication, placing it within the scope of authenticated insider threats or compromised credentials rather than unauthenticated remote exploitation.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Administrators should apply vendor-provided patches that update the Gitea version to one where the checksum upload handler enforces size limits before allocating memory buffers. In environments where patching is not immediately feasible, network-level controls such as Web Application Firewalls (WAF) can be configured to inspect HTTP POST requests targeting Maven endpoints and drop payloads exceeding a defined byte threshold, effectively blocking oversized uploads at the perimeter. Additionally, implementing rate limiting on authentication tokens associated with package publishing privileges can reduce the speed of potential memory exhaustion attacks. Developers should also review other upload handlers in their deployment to ensure that similar patterns of reading full bodies before validation are not present elsewhere in the codebase, ensuring a consistent security posture across all file ingestion points.