CVE-2026-63021

Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing...

CVE-2026-62925

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionatel...

CVE-2026-73273

Gitea versions ≤ 1.27.2 are vulnerable to a memory exhaustion issue in the Maven upload handler . When a Maven artifact is uploaded with a checksum extension (e.g., ".md5", ".sha256"), the handler uses io.ReadAll to read the entire request body into memory before enforcing the LIMIT_SIZE_MAVEN qu...

CVE-2026-63021

Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing...

CVE-2026-63021

Gitea versions

CVE-2026-62925 Gitea Alpine package parsing memory exhaustion

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionatel...

CVE-2026-62925

Gitea versions

CVE-2026-62925

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionatel...

EUVD-2026-101082

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionatel...

Embedded Malicious Code

Overview jscrambler is a Jscrambler Code Integrity API client. Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a cross-platform infostealer. A malicious actor compromised an npm publishing credential associated with Jscrambler, which allowed the attacker ...

CVE-2026-23940

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of...

MAL-2025-187269 Malicious code in halley-pm2-semantic-ui-commitlint-config-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 207baa0abd8ece63fe60c3b6ed72245a1fbd0ab7acbb419f0f280f5e15470fb9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kisut-dfg-diwfzcfecdcb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c6bf951cd0f38cbfc386e36adc18750ce5a8655034cd54a99e0c2cd60fc01ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in imugay-avg-ijimaumfaagf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d05585775081be3865ed78608802ecda2707f34afac2a9bdad1c236dae06889b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in irfan-poke23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c525902ab84ec722686e638cd7ee99e826076d2caa6bdcb2b15aacdf7c5ba339 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eclipseobserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8141fdfe488ff11c55511483d8fbd0d49ffb94e1e6570379cf410f4ebfdffc49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fadila-poke112 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b0f6e6b541e5e82c51909928caef30310b206438c7b01afc5fd2b69e057f1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in namada-kasito-nutro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 469707a92f7f1415f2443981bbca6e84654c69b89ffd5a5ca48f53879bf235e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-lokcek9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ab9432c4ac98d57f8c08edcf7f802ea599fe5d019add52336dd3ea506291b05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sanctum-cookik-raimu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1c13e7a3649769826894e42c234435e476bb134c33d36be73a2cf69544e1c40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...