CVE-2026-42931

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0

Description An authenticated user can cause a denial of service by sending a large HTTP request to the NPM package tag API endpoint. The AddPackageTag() function reads the entire request body into memory using io.ReadAll() without validating the size. This leads to an Out-of-Memory (OOM) condition that crashes the entire server process. Because the server-side size limits are not enforced for this specific endpoint, a single request containing data roughly 80% of the available system memory is sufficient to trigger the crash. Concurrent requests can result in a persistent denial of service that survives automatic restarts.

API Endpoint: /api/packages/{owner}/npm/-/package/{id}/dist-tags/{tag}

Recommendations Update Gitea to version 1.27.0 or later. As a temporary mitigation, restrict access to the /api/packages/{owner}/npm/-/package/{id}/dist-tags/{tag} endpoint to trusted users only.