Gitea parses Alpine package uploads before enforcing package‑size quotas, decompressing the .PKGINFO data and enumerating dependency entries without bounding the result. An authenticated user with package‑publish rights can upload a tiny but highly compressed archive that expands into a vastly larger amount of data during parsing and metadata generation, causing an uncontrolled allocation that can exhaust memory and terminate or otherwise disrupt the Gitea process. This weakness matches CWE‑400 and can lead to a denial of service of the entire instance or associated services.

All Gitea installations running versions older than v1.27.3 that accept Alpine packages are affected. The vulnerable code path exists in all releases prior to the fix released in 1.27.3, regardless of the operating system.

The CVSS score of 6.5 indicates moderate severity. Exploitation requires authentication with package‑publish permissions, therefore it primarily represents an internal or credential‑compromise scenario. The EPSS score is below 1 %, implying a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, an attacker who successfully uploads an exploitative package can cause uncontrolled memory allocation, leading to a crash or unresponsiveness of the Gitea process and resulting in service disruption.