Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Oct 14, 2026 · NIST NVD

   Detected

   Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause requ

2. Oct 14, 2026 · NIST NVD

   Updated

   Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause requ

Sources

• CVE.orgVulnerability recordCVE-2026-63021

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-63021

  30-day exploitation probability 0.5%

  first.org
• NIST NVDVulnerability recordCVE-2026-63021

  Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests,

  nvd.nist.gov

References

• Reference · blog.gitea.com
• Reference · github.com
• Reference · github.com
• Reference · github.com
• Reference · github.com