ZeroDay Findings
Sign inSign up

Findings

CVE-2026-73130

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API.

Published Oct 14, 2026 · updated Oct 14, 2026

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can submit an oversized value to amplify template reads and memory use, impairing availability.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can submit an oversized value to amplify template reads and memory use, impairing availability.

  2. Oct 14, 2026 · NIST NVD

    Updated

    Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can submit an oversized value to amplify template reads and memory use, impairing availability.

Sources

  • CVE.orgVulnerability recordCVE-2026-73130

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-73130

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDVulnerability recordCVE-2026-73130

    Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create r

    nvd.nist.gov

References