Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-117677— Gitea Helm chart upload decompression denial of service

Quick assessment

Affected

Gitea Gitea

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在解析上传的 Helm 图表时，Gitea 会解压归档文件并遍历其中的所有 tar 条目以查找，但在此过程中未对解压后的大小进行限制，且该操作发生在检查包大小配额之前；而该配额仅考虑压缩后的上传大小。因此，拥有对某个所有者（例如在允许公开注册的实例中拥有自身账户的包写入权限）的用户，可以反复上传体积小但高度压缩的归档文件，迫使服务器消耗与解压后大小成比例的 CPU 时间，从而降低 Gitea 实例的可用性。该问题不会导致代码执行或数据访问。

AI Predicted 5.9 Difficulty: Easy Updated Nov 01, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Gitea	Gitea	`< 28.3.0`	affected

Updated Nov 01, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Gitea Helm chart upload decompression denial of service

Source: CVE Program / CVE List V5

Vulnerability Description

When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write access to an owner, for example their own account on an instance with open registration, could repeatedly upload small, highly compressed archives that make the server spend CPU time proportional to the decompressed size, degrading the availability of the Gitea instance. The issue does not allow code execution or data access.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

未加控制的资源消耗(资源穷尽)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Gitea	Gitea	0 ~ 28.3.0	-

II. Public POCs for CVE-2026-117677

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117677

请登录查看更多情报信息。

Other References for CVE-2026-117677 (5)

https://github.com/go-gitea/gitea/releases/tag/v28.3.0 release-notes
https://blog.gitea.com/release-of-28.3.0/ release-notes
https://github.com/go-gitea/gitea/pull/39942 patch
https://github.com/go-gitea/gitea/security/advisories/GHSA-r6mh-qg79-rqj2 vendor-advisory
https://github.com/go-gitea/gitea/pull/40085 patch

https://www.cve.org/CVERecord?id=CVE-2026-117677

Same Patch Batch · Gitea · 2026-11-01 · 20 CVEs total

CVE-2026-117646		Gitea private repository listing to public-only tokens on profiles
CVE-2026-118386		Gitea Actions fork workflow trust through pull request review commit
CVE-2026-120263		Gitea OAuth2 account auto-linking takeover through the sign-up form
CVE-2026-112887		Gitea Actions task token private repository enumeration
CVE-2026-113429		Gitea stored XSS through legacy Actions artifact Content-Encoding
CVE-2026-114199		Gitea contribution heatmap private activity disclosure to public-only tokens
CVE-2026-116289		Gitea public-only token bypass through Actions runner registration
CVE-2026-116296		Gitea archived repository release, milestone and label modification
CVE-2026-116474		Gitea Actions job token spoofing of instance-signed commits
CVE-2026-117635		Gitea admin API public-only token scope bypass
CVE-2026-119627		Gitea limited-visibility profile disclosure with public-only tokens
CVE-2026-117649		Gitea private issue disclosure through issue dependency timeline events
CVE-2026-117685		Gitea public-only package token access to private OCI blobs
CVE-2026-118394		Gitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-118395		Gitea public-only token bypass in repository and organization creation
CVE-2026-118504		Gitea issue changes on archived repositories through the API
CVE-2026-119441		Gitea public-only token bypass on bulk organization repository deletion
CVE-2026-119533		Gitea private pull request disclosure on project boards
CVE-2026-119625		Gitea user and organization feed token scope bypass

IV. Related Vulnerabilities

Same product: Gitea

Same vendor: Gitea

Same weakness: CWE-400