The vulnerability occurs when Gitea’s Maven upload handler reads checksum uploads entirely into memory before enforcing the package-size quota. An authenticated user with package‑publish permission can submit an oversized body to a checksum endpoint, even though legitimate checksum values are at most 128 bytes. This bypasses the quota check and forces the server to allocate large amounts of memory for each request, which can exhaust server resources and trigger a denial‑of‑service condition. The weakness is identified as CWE‑770.

Gitea is the affected vendor. No specific fixed version information is provided, so operators should consider all current Gitea installations as potentially vulnerable until a patch is released.

The CVSS score of 4.3 suggests medium severity. The EPSS score of 0.00389 (<1%) indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attacking requires prior authentication and the ability to publish packages, so the attack vector is authenticated. Once those prerequisites are met, an attacker can send large checksum payloads and drain server memory until the service becomes unresponsive. The likelihood of exploitation is moderate, but the impact—a denial‑of‑service due to memory exhaustion—remains significant.