https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 16:21:33 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352310 EUVD-2026-352310 https://cve.radiocsirt.org/vuln/euvd-2026-352310 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42931 <p>Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint</p> <p>Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42931 https://cve.radiocsirt.org/vuln/ghsa-wwqq-x6w4-frm2 <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary An unbounded `io.ReadAll(ctx.Req.Body)` call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory (OOM) kill. With concurrent requests, the attack produces a persistent denial of service that survives automatic restarts.</p> <p>### Details The [`AddPackageTag`](https://github.com/go-gitea/gitea/blob/a12f9807933bd463368c6111dbc283d8a65f20f7/routers/api/packages/npm/npm.go#L336) function reads the entire HTTP request body into memory using `io.ReadAll()` with no size validation:</p> <p>```go // routers/api/packages/npm/npm.go:332-341 func AddPackageTag(ctx *context.Context) { packageName := packageNameFromParams(ctx)</p> <p>body, err := io.ReadAll(ctx.Req.Body) // NO SIZE LIMIT if err != nil { apiError(ctx, http.StatusInternalServerError, err) return } version := strings.Trim(string(body), &#34;\&#34;&#34;) // ... } ```</p> <p>This route is registered at [`routers/api/packages/api.go:433`](https://github.com/go-gitea/gitea/blob/a12f9807933bd463368c6111dbc283d8a65f20f7/routers/api/packages/api.go#L433): ```go r.Group(&#34;/-/package/{id}/dist-tags&#34;, func() { // ... r.Group(&#34;/{tag}&#34;, func() { r.Put(&#34;&#34;, npm.AddPackageTag) // reqPackageAccess(perm.AccessModeWrite) r.Delete(&#34;&#34;, npm.DeletePackageTag) }) }) ```</p> <p>**Why this causes OOM and not just a slow request:**</p> <p>In Go, `…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary An unbounded `io.ReadAll(ctx.Req.Body)` call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory (OOM) kill. With concurrent requests, the attack produces a persistent denial of service that survives automatic restarts.</p> <p>### Details The [`AddPackageTag`](https://github.com/go-gitea/gitea/blob/a12f9807933bd463368c6111dbc283d8a65f20f7/routers/api/packages/npm/npm.go#L336) function reads the entire HTTP request body into memory using `io.ReadAll()` with no size validation:</p> <p>```go // routers/api/packages/npm/npm.go:332-341 func AddPackageTag(ctx *context.Context) { packageName := packageNameFromParams(ctx)</p> <p>body, err := io.ReadAll(ctx.Req.Body) // NO SIZE LIMIT if err != nil { apiError(ctx, http.StatusInternalServerError, err) return } version := strings.Trim(string(body), &#34;\&#34;&#34;) // ... } ```</p> <p>This route is registered at [`routers/api/packages/api.go:433`](https://github.com/go-gitea/gitea/blob/a12f9807933bd463368c6111dbc283d8a65f20f7/routers/api/packages/api.go#L433): ```go r.Group(&#34;/-/package/{id}/dist-tags&#34;, func() { // ... r.Group(&#34;/{tag}&#34;, func() { r.Put(&#34;&#34;, npm.AddPackageTag) // reqPackageAccess(perm.AccessModeWrite) r.Delete(&#34;&#34;, npm.DeletePackageTag) }) }) ```</p> <p>**Why this causes OOM and not just a slow request:**</p> <p>In Go, `…</p> https://cve.radiocsirt.org/vuln/ghsa-wwqq-x6w4-frm2 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304