CVE-2026-42931
published 2026-08-13CVE-2026-42931: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
PriorityP432medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.53%
44.0th percentile
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
| gitea | gitea_open_source_git_server | <= 1.24 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
ghsa·2026-07-21
CVE-2026-42931 [MEDIUM] CWE-770 Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
### Summary
An unbounded `io.ReadAll(ctx.Req.Body)` call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory (OOM) kill. With concurrent requests, the attack produces a persistent denial of service that survives automatic restarts.
### Details
The [`AddPackageTag`](https://github.com/go-gitea/gitea/blob/a12f9807933bd463368c6111dbc283d8a65f20f7/routers/api/packages/npm/npm.go#L336) function reads the entire HTTP request body into memory using `io.ReadAll()` with no size validation:
```go
// routers/api/packages/npm/npm.go:332-341
func AddPacka
Red Hat
code.gitea.io/gitea: Gitea: Denial of Service due to unbounded memory consumption in NPM package tag endpoint
vendor_redhat·2026-08-13·CVSS 6.5
CVE-2026-42931 [MEDIUM] CWE-770 code.gitea.io/gitea: Gitea: Denial of Service due to unbounded memory consumption in NPM package tag endpoint
code.gitea.io/gitea: Gitea: Denial of Service due to unbounded memory consumption in NPM package tag endpoint
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
A flaw was found in Gitea. An authenticated attacker can trigger a denial of service by sending a large HTTP request to the NPM package tag API endpoint. The server attempts to read the entire request body into memory without a size limit, leading to an Out-of-Memory (OOM) error and crashing the Gitea instance. This can result in a persistent denial of service, making all hosted services unavailable to users.
Statement: A flaw was found in Gitea. An authenticated attacker can trigger a denial of service by sending a large HTTP request to the NPM package tag API endpoint. The server reads the entire request bo
No detection rules found.
No public exploits indexed.
2026-08-13
Published