CVE-2026-56755

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The Debian package registry parser contains two issues that can lead to a complete denial of service. First, an unbounded decompression flaw exists in the ParseControlFile() function. When processing an uploaded .deb file, the parser decompresses control.tar.gz and copies the stream into a strings.Builder without limiting the amount of data read. An attacker can use a decompression bomb—a small payload that expands to a massive size—to exhaust server memory. Second, the parser uses += for string concatenation when processing continuation lines in the Description field, resulting in O(N²) allocation and copy operations. This can saturate the CPU and trigger frequent garbage collection cycles. Any authenticated user with write access to the package registry can trigger these issues via a request to the handler at routers/api/packages/debian/debian.go:146.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.