CVE-2026-42931

The Gitea application is vulnerable to a Denial of Service (DoS) attack due to the use of Unbounded io.ReadAll in the NPM Package Tag Endpoint . This vulnerability allows for the allocation of resources without limits or throttling, potentially leading to service exhaustion. Users are encouraged ...

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...