This vulnerability allows a user with access to a Gitea Actions runner to send an arbitrarily large payload to the artifact v4 (Twirp) handlers. The server reads the entire request body into memory without a limit, which causes the process to consume all available memory and eventually terminate. The impact is a denial‑of‑service that takes the entire Gitea instance offline.

The defect is present in Gitea installations that use the Actions artifact v4 API, specifically any releases prior to 28.2.0. The fix was released in Gitea v28.2.0, which limits the request body to 1 MiB.

Exploitation requires the attacker to be able to run a workflow and obtain the associated runner token, implying that the attacker already has privileged repository or deployment access. Once the oversized request is sent, the server will abort, disrupting service availability. No CVSS score is published, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. The risk to availability is significant for systems that cannot tolerate downtime, though achieving the initial conditions may be difficult for an unauthenticated adversary.