Medium [CVE-2026-42931] Denial of Service due to unbounded memory consumption in NPM package tag endpoint
This medium-severity Red Hat Linux advisory covers CVE-2026-42931.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint A flaw was found in Gitea. The server attempts to read the entire request body into memory without a size limit, leading to an Out-of-Memory (OOM) error and crashing the Gitea instance.
This can result in a persistent denial of service, making all hosted services unavailable to users. Red Hat products that bundle code.gitea.io/gitea as a Go dependency are affected by this vulnerability.
Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- If a reverse proxy (e.g., nginx, HAProxy) sits in front of the Gitea-bundling application, configure a maximum client request body size (e.g., client_max_body_size 100m in nginx) to limit the data that can reach the vulnerable endpoint. This does not fully remediate the issue but reduces the attack surface.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.