Gitea decompresses uploaded Helm chart archives without imposing a limit on the decompressed size, before checking the compressed package quota. An attacker with package write permission can upload many small, highly compressed archives that trigger large decompression operations, consuming significant CPU resources and degrading the availability of the instance. The flaw does not allow code execution or unauthorized data access; its impact is limited to availability.

All Gitea installations running a version older than 28.3.0 are affected. The vulnerability is present in the Gitea product as distributed in the community and enterprise editions, regardless of the operating environment. No specific operating system or host configuration is required beyond the standard Gitea deployment.

Because the flaw is purely denial‑of‑service, the risk profile is driven by the availability impact rather than confidentiality or integrity compromise. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of a decompression limit offers a straightforward attack path for any account with write access in a public or open‑registration instance. An attacker does not need elevated privileges beyond normal writability, and the attack requires only uploading a Helm chart, which is a simple, automated process. The available CVSS score is not provided, but the described resource exhaustion is considered a high‑severity denial‑of‑service issue. The attack can be launched from remote hosts without additional network weaknesses, making the exploitation probability moderate to high in exposed installations.