The vulnerability exists in the NPM package tag endpoint of the Gitea open source Git server. An attacker can trigger a denial of service by sending a request that causes io.ReadAll to read an unbounded payload. This can exhaust system resources and halt the affected service. The weakness corresponds to CWE-770, describing unbounded resource consumption.

Entities running the Gitea Git server are affected. The CNA lists the product as Gitea: Gitea Open Source Git Server, but specific version numbers are not supplied in the advisory. Users should consult the vendor release notes to determine whether their installation is at risk; the problem was addressed in the 1.27.0 release.

The EPSS score is not provided, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score is 6.5, indicating a moderate severity. From the description, the attack requires network access to the NPM package tag HTTP endpoint, indicating a remote exploitation path. The exploit appears simple—sending a large payload—but the absence of a documented attack vector means the real-world exploitation likelihood is uncertain.