CVE-2026-117677
Last modified
CVE-2026-117677 is a vulnerability of currently unknown severity. When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write access to an owner, for example their own account on an instance with open registration, could repeatedly upload small, highly compressed archives that make the server spend CPU time proportional to the decompressed size, degrading the availability of the Gitea instance. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write access to an owner, for example their own account on an instance with open registration, could repeatedly upload small, highly compressed archives that make the server spend CPU time proportional to the decompressed size, degrading the availability of the Gitea instance. The issue does not allow code execution or data access.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Gitea | Gitea | < 28.3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-117677?
How severe is CVE-2026-117677?
How do I fix CVE-2026-117677?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-117649The issue timeline API and the web issue page hid cross-refe…3.5
- CVE-2026-11765Improper neutralization of argument delimiters in a command …3.3
- CVE-2026-117656Acceptance of Extraneous Untrusted Data With Trusted Data vu…9.3
- CVE-2026-11766The Ultimate Member WordPress plugin before 2.12.0 does not…8
- CVE-2026-117666Improper Validation of Certificate with Host Mismatch vulner…9.1
- CVE-2026-11767The Free Builder for Elementor WordPress plugin before 1.6…8.8
- CVE-2026-117679A cross-site scripting vulnerability exists in SHIRASAGI, wh…5.1
- CVE-2026-117680Improper Check for Unusual or Exceptional Conditions vulnera…2.1
- CVE-2026-117681A flaw was found in konflux-ci. This vulnerability allows pr…8
- CVE-2026-117685The OCI registry's cross-repository blob mount checked the t…9.1
- CVE-2026-117688A flaw was found in the client registration component of Key…5.3
- CVE-2026-11769We have released version 5.24.0 of the Grafana Operator. Thi…8.8
Are you affected by CVE-2026-117677?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST