PT-2026-134876

CVE-2026-117677

Published

2026-11-01

Updated

2026-11-01

Description by

Score

N/A

Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description When parsing an uploaded Helm chart, the software decompresses the archive and reads every tar entry to locate Chart.yaml without limiting the decompressed size. This process occurs before the package size quota is verified, as the quota only accounts for the compressed upload size. A user with package write access can upload small, highly compressed archives, causing the server to consume CPU time proportional to the decompressed size, which degrades the availability of the instance. This issue does not allow code execution or data access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)

CWE-400: Uncontrolled Resource Consumption

Related identifiers

CVE-2026-117677