CVE-2026-59763

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Title source: CVE List
STIX 2.1 vulnerability

Description

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Gitea Open Source Git Server

Browse Gitea / Gitea Open Source Git Server

Default status: unaffected

CVE ListThrough 1.26.4affected

code.gitea.io/gitea

Browse Go / code.gitea.io/gitea
GitHub AdvisoryBefore 1.27.0 · Fixed in 1.27.0affected

References

8