/
← Voltar ao feed
high technology software_development

CVE-2026-42931: Gitea npm Package Registry unbounded request body read allows single-request DoS

1 fonte(s) · 1 atualização(ões) · publicado 14/08/2026 17:43 · coletado há 2 dias

A denial-of-service vulnerability, CVE-2026-42931, affects the npm endpoint of the Gitea Package Registry. The AddPackageTag function reads the entire HTTP request body into memory with io.ReadAll() before any validation, so a single oversized request can crash the whole Gitea process. Any authenticated user can trigger it against their own package namespace, and because self-registration is enabled by default, an attacker can create an account and exploit it immediately. The flaw was reproduced on Gitea 1.26.2 and fixed in Gitea 1.27.0 (released July 12, 2026). The article does not report exploitation in the wild, but it includes a working proof of concept.

Detalhes técnicos

  • Root cause: In routers/api/packages/npm/npm.go, AddPackageTag calls io.ReadAll(ctx.Req.Body) with no size limit. This is CWE-770 (Allocation of Resources Without Limits or Throttling).
  • Limits not applied: The LIMIT_SIZE_* settings apply only to package uploads, and the default is unlimited (-1). HashedBuffer, which spills to disk after 32 MiB, is not used in this function.
  • Failure mode: Memory allocation failure triggers the Go runtime.throw("out of memory"), which terminates the entire process rather than a single goroutine.
  • Access requirement: The route needs only write access to the caller's own namespace, and services/context/package.go grants owner permission when the user matches the namespace owner. The package does not need to exist, and the OOM occurs before the database lookup.
  • Attack path: The attacker sends a PUT request to /api/packages/{username}/npm/-/package/{any}/dist-tags/{any} with a body of hundreds of MiB (null bytes are sufficient).
  • Impact: In a 512 MiB container, a ~400 MiB request killed the server. About 20 concurrent threads keep the instance in a crash-restart loop even with restart: always. Repositories, packages, issues, pull requests, Gitea Actions and integrations become unavailable.
  • Exposure: The Package Registry is enabled by default.

Remediação

  • Upgrade to Gitea 1.27.0 or later. The fix is in PR #38406 (commit f69e15a) and wraps the body read in io.LimitReader() with a 4 KiB cap.
  • Where patching is delayed, consider disabling open self-registration and limiting exposure of the instance. These are general mitigations and are not stated in the article.
  • Advisory reference: GHSA-wwqq-x6w4-frm2.

Linha do tempo

  1. yokai.hakaisecurity.io ↗ · pub. 14/08/2026 17:43 · coletado 19/10 18:03 primeiro registro

    CVE-2026-42931: Gitea npm Package Registry unbounded request body read allows single-request DoS

    ler a análise desta fonte

    A denial-of-service vulnerability, CVE-2026-42931, affects the npm endpoint of the Gitea Package Registry. The AddPackageTag function reads the entire HTTP request body into memory with io.ReadAll() before any validation, so a single oversized request can crash the whole Gitea process. Any authenticated user can trigger it against their own package namespace, and because self-registration is enabled by default, an attacker can create an account and exploit it immediately. The flaw was reproduced on Gitea 1.26.2 and fixed in Gitea 1.27.0 (released July 12, 2026). The article does not report exploitation in the wild, but it includes a working proof of concept.

    Technical Details

    • Root cause: In routers/api/packages/npm/npm.go, AddPackageTag calls io.ReadAll(ctx.Req.Body) with no size limit. This is CWE-770 (Allocation of Resources Without Limits or Throttling).
    • Limits not applied: The LIMIT_SIZE_* settings apply only to package uploads, and the default is unlimited (-1). HashedBuffer, which spills to disk after 32 MiB, is not used in this function.
    • Failure mode: Memory allocation failure triggers the Go runtime.throw("out of memory"), which terminates the entire process rather than a single goroutine.
    • Access requirement: The route needs only write access to the caller's own namespace, and services/context/package.go grants owner permission when the user matches the namespace owner. The package does not need to exist, and the OOM occurs before the database lookup.
    • Attack path: The attacker sends a PUT request to /api/packages/{username}/npm/-/package/{any}/dist-tags/{any} with a body of hundreds of MiB (null bytes are sufficient).
    • Impact: In a 512 MiB container, a ~400 MiB request killed the server. About 20 concurrent threads keep the instance in a crash-restart loop even with restart: always. Repositories, packages, issues, pull requests, Gitea Actions and integrations become unavailable.
    • Exposure: The Package Registry is enabled by default.

    Remediation

    • Upgrade to Gitea 1.27.0 or later. The fix is in PR #38406 (commit f69e15a) and wraps the body read in io.LimitReader() with a 4 KiB cap.
    • Where patching is delayed, consider disabling open self-registration and limiting exposure of the instance. These are general mitigations and are not stated in the article.
    • Advisory reference: GHSA-wwqq-x6w4-frm2.