Gitea’s Swift package parser enforces a per‑manifest size limit of 128 KiB but disregards the total number or combined size of manifests inside an archive. An authenticated user with package‑publish rights can upload a highly compressed archive that contains many manifests. When Gitea expands and reads these manifests into memory, the actual allocation required can far exceed the archive size, potentially exhausting the server’s memory, causing the process to terminate or generating request failures.

This flaw affects the Gitea application. All installations running a Gitea version older than the patched release (available in Gitea 1.27.3 and later) are vulnerable. The patch implements limits on the total manifest size and the number of manifests processed in one upload.

The CVSS score of 6.5 categorizes the vulnerability as moderate. Its EPSS score is below 1 %, indicating a low probability of observed exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires a valid Gitea account with package‑publish permission, so the threat is confined to compromised or malicious insider accounts. Once authenticated, the attacker can trigger memory exhaustion and compromise the availability of the Gitea instance.