Tricta

**Name of the Vulnerable Software and Affected Versions** Gitea versions prior to 1.27.0 **Description** An authenticated user can cause a denial of service by sending a large HTTP request to the NPM package tag API endpoint. The `AddPackageTag()` function reads the entire request body into memory using `io.ReadAll()` without validating the size. This leads to an Out-of-Memory (OOM) condition that crashes the entire server process. Because the server-side size limits are not enforced for this specific endpoint, a single request containing data roughly 80% of the available system memory is sufficient to trigger the crash. Concurrent requests can result in a persistent denial of service that survives automatic restarts. **API Endpoint:** `/api/packages/{owner}/npm/-/package/{id}/dist-tags/{tag}` **Recommendations** Update Gitea to version 1.27.0 or later. As a temporary mitigation, restrict access to the `/api/packages/{owner}/npm/-/package/{id}/dist-tags/{tag}` endpoint to trusted users only.