CVE-2026-62925

CVE-2026-62925 · Gitea Alpine package parsing memory exhaustion

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts. An authenticated user with package-publish permission can upload a small, highly compressed archive that causes disproportionately large memory allocations during parsing and metadata generation. On memory-constrained deployments, this can terminate the process or otherwise disrupt availability.

CVSS 6.5 · Средний · EPSS 0,5%

Опубликовано

2026-10-14T14:28:51.472Z

Обновлено

2026-10-14T15:20:54.502Z

Проверьте свой сервер →