CVE-2026-63021: Gitea Swift package manifest memory exhaustion

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-14
Weakness: CWE-400

Description

Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause request failures.

Affected products

Gitea Open Source Git Server: through 1.27.2

References

https://blog.gitea.com/release-of-1.27.3/
https://github.com/go-gitea/gitea/pull/39025
https://github.com/go-gitea/gitea/pull/39032
https://github.com/go-gitea/gitea/releases/tag/v1.27.3
https://github.com/go-gitea/gitea/security/advisories/GHSA-fqxf-w92m-prvq

Get alerted when CVE-2026-63021 or the next vulnerability affects your stack