CVE-2026-73273 Gitea CVE debrief

Who should care

Defenders responsible for Gitea instances with package-publish permissions enabled should assess exposure and potential memory exhaustion impact. They should prioritize verifying Gitea instances and review compensating controls for exposed systems. Security teams and vulnerability management teams should also review and limit package-publish permissions for authenticated users.

Why it matters

Defenders should prioritize verifying exposure and assessing potential memory exhaustion impact on Gitea instances with package-publish permissions enabled. This vulnerability allows authenticated users to bypass upload quotas and potentially exhaust server memory.

• Potential memory exhaustion due to oversized checksum uploads
• Upload quota bypass for authenticated users with package-publish permissions
• Possible denial of service due to server memory exhaustion

Technical summary

Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This bypasses the upload quota on that path and can exhaust server memory, impacting Gitea instances with package-publish permissions enabled. Defenders should prioritize verifying exposure and assessing potential memory exhaustion impact.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential memory exhaustion impact on Gitea instances with package-publish permissions enabled.

Recommended defensive actions

• Verify Gitea instance exposure and assess potential memory exhaustion impact
• Review and limit package-publish permissions for authenticated users
• Monitor server memory usage and adjust quotas as necessary
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. Defenders should verify Gitea instances with package-publish permissions enabled and assess potential memory exhaustion impact. The vulnerability allows authenticated users to bypass upload quotas and potentially exhaust server memory. Evidence is limited to CVE Program records and source item details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.