CVE-2026-73273

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The Maven upload handler reads checksum uploads entirely into memory before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint, bypassing the upload quota and potentially exhausting server memory. This occurs because legitimate checksum values are typically at most 128 bytes, but the system does not restrict the size of the input before processing it in memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.