CVE-2026-62925: Gitea 0 through 1.27.2

Affected technology

Gitea · 0 through 1.27.2
Gitea

Description’s affected range: before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts

Component: Not specified by the source

What an attacker can do

An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionately large memory allocations during parsing and metadata generation.