CVE-2026-117677 Gitea CVE debrief

Who should care

Defenders and administrators of Gitea instances should assess exposure, especially in environments where users have package write access. They should verify and apply patches or updates, restrict access as needed, and monitor server resource usage.

Why it matters

Defenders should care about CVE-2026-117677 because it allows users with package write access to potentially degrade the availability of a Gitea instance by uploading highly compressed archives. This can lead to excessive CPU usage, impacting server performance and resource utilization. Verification and mitigation are crucial, especially in environments with open user registration or where users have package write access.

• Potential degradation of Gitea instance availability due to excessive CPU usage
• Need for verification of patch application or workarounds
• Possible impact on server resource usage and performance

Technical summary

The issue arises from Gitea's handling of uploaded Helm charts. When parsing an uploaded chart, Gitea decompresses the archive and reads every tar entry in search of `Chart.yaml` without limiting the decompressed size. This process occurs before the package size quota is checked, and the quota only considers the compressed upload size. A user with package write access can exploit this by repeatedly uploading small, highly compressed archives. This causes the server to spend CPU time proportional to the decompressed size, potentially degrading the availability of the Gitea instance.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in environments where users have package write access.

Recommended defensive actions

• Verify and apply the patch or update to version 28.3.0 or later
• Restrict package write access to trusted users
• Monitor server resource usage and adjust quotas as needed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by Gitea's decompression and parsing of uploaded Helm charts without limiting the decompressed size before checking the package size quota. This can be exploited by users with package write access to repeatedly upload small, highly compressed archives, causing the server to spend excessive CPU time.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.