Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Gitea | Gitea | unaffected |
|
No data.
No data.
No data available yet.
No solution or workaround provided in the CVE record.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 14 Oct 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This bypasses the upload quota on that path and can exhaust server memory. | |
| Title | Gitea Maven checksum upload quota bypass and memory exhaustion | |
| Weaknesses | CWE-770 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-10-14T15:03:16.838Z
Reserved: 2026-08-13T16:50:59.180Z
Link: CVE-2026-73273
Vulnrichment
Updated: 2026-10-14T14:43:21.380Z
NVD
Status : Deferred
Published: 2026-10-14T15:17:23.410
Modified: 2026-10-14T16:17:53.353
Link: CVE-2026-73273
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-770
Allocation of Resources Without Limits or Throttling