CVE-2026-63021

Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing...

CVE-2026-62925

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionatel...

CVE-2026-73273

Gitea versions ≤ 1.27.2 are vulnerable to a memory exhaustion issue in the Maven upload handler . When a Maven artifact is uploaded with a checksum extension (e.g., ".md5", ".sha256"), the handler uses io.ReadAll to read the entire request body into memory before enforcing the LIMIT_SIZE_MAVEN qu...

CVE-2026-73273 Gitea Maven checksum upload quota bypass and memory exhaustion

Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This...

CVE-2026-63021

Gitea versions

CVE-2026-63021

Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing...

CVE-2026-62925

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionatel...

CVE-2026-62925

Gitea versions

CVE-2026-62925 Gitea Alpine package parsing memory exhaustion

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionatel...

CVE-2026-62925 Gitea Alpine package parsing memory exhaustion

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionatel...

EUVD-2026-101082

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionatel...

Embedded Malicious Code

Overview jscrambler is a Jscrambler Code Integrity API client. Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a cross-platform infostealer. A malicious actor compromised an npm publishing credential associated with Jscrambler, which allowed the attacker ...

CVE-2026-23940

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of...

MAL-2025-187269 Malicious code in halley-pm2-semantic-ui-commitlint-config-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 207baa0abd8ece63fe60c3b6ed72245a1fbd0ab7acbb419f0f280f5e15470fb9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kisut-dfg-diwfzcfecdcb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c6bf951cd0f38cbfc386e36adc18750ce5a8655034cd54a99e0c2cd60fc01ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in imugay-avg-ijimaumfaagf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d05585775081be3865ed78608802ecda2707f34afac2a9bdad1c236dae06889b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in irfan-poke23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c525902ab84ec722686e638cd7ee99e826076d2caa6bdcb2b15aacdf7c5ba339 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eclipseobserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8141fdfe488ff11c55511483d8fbd0d49ffb94e1e6570379cf410f4ebfdffc49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sanctum-cookik-raimu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1c13e7a3649769826894e42c234435e476bb134c33d36be73a2cf69544e1c40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156685 Malicious code in inufgi-gotmafa-anamufozai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2962dcf3fce32051f68d174c4ae17c790ac440921b2c146af58815b9b7a8cfb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...