CVE-2026-42931

CVE-2026-42931 concerns Gitea’s NPM Package Tag Endpoint. Multiple sources confirm a Denial of Service arising from an unbounded read via io.ReadAll in that endpoint, impacting Gitea deployments that rely on the affected NPM tag endpoint. The root cause is described as unbounded resource usage du...

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...