VDB
CVE-2026-73130
CVE-2026-73130
PUBLISHED
CVSS 4.3 MEDIUM
Reported by Gitea · Published October 14, 2026
Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can submit an oversized value to amplify template reads and memory use, impairing availability.
Risk Scores
CVSS 3.1
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitea | Gitea | 0 |
| Gitea | Gitea | 0 |
| alpine | gitea | 0 |
Timeline
- Oct 14, 2026 CVE Published
- Oct 14, 2026 CVE Updated
- Oct 15, 2026 EPSS Score
- Oct 19, 2026 EPSS Score
- Oct 21, 2026 EPSS Score
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score
References
- GitHub Security Advisory GHSA-8r3w-5682-jrqf vendor-advisory
- Gitea 1.27.3 release announcement release-notes
- Fix: go-gitea/gitea pull request #39027 patch
- Fix: go-gitea/gitea pull request #39040 patch
- go-gitea/gitea v1.27.3 release release-notes