CVE-2026-62925

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description An authenticated user with package-publish permission can upload a small, highly compressed Alpine package archive. The software parses these uploads before enforcing package-size quotas and fails to bound the decompressed .PKGINFO data, dependency, and provides entry counts. This leads to disproportionately large memory allocations during parsing and metadata generation, which can terminate the process or disrupt availability on memory-constrained deployments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.