CVE-2026-63021

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The Swift package parser does not limit the total number of manifests or their combined size before loading them into memory, although individual manifests are limited to 128 KiB. An authenticated user with package-publish permissions can upload a highly compressed archive containing numerous manifests. This leads to memory allocations significantly larger than the original archive, which may exhaust system memory, terminate the process, or result in request failures.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.