CVE-2026-73273
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Oct 14, 2026
Vendor
unknown
Description
Gitea's Maven upload handler reads checksum uploads entirely into memory and returns before enforcing package-size quotas. An authenticated user with package-publish permission can submit an oversized body to a checksum endpoint despite legitimate checksum values being at most 128 bytes. This bypasses the upload quota on that path and can exhaust server memory.