{"id":"EUVD-2026-58125","enisaUuid":"886e2d05-b32a-3a56-aea2-0aabcd6395e8","description":"Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads","datePublished":"Aug 13, 2026, 4:44:58 PM","dateUpdated":"Aug 13, 2026, 6:49:48 PM","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5\nhttps://github.com/go-gitea/gitea/releases/tag/v1.27.0\nhttps://blog.gitea.com/gitea-1.27.0-is-released/\n","aliases":"CVE-2026-59763\nGHSA-9mq6-mqjj-c2c5\n","assigner":"Gitea","epss":0.29,"enisaIdProduct":[{"id":"cf2a096e-6924-3ab0-8ada-54805075b17a","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.4"}],"enisaIdVendor":[{"id":"ea642b13-5ff7-3d98-a53f-1e6892ebd3d5","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"63e1a7f2-2499-324a-a2bb-18a4762bd50b","vulnerability":{"id":"GHSA-9mq6-mqjj-c2c5","description":"Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads","datePublished":"Jul 21, 2026, 8:20:49 PM","dateUpdated":"Jul 21, 2026, 8:20:49 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5\nhttps://github.com/go-gitea/gitea/pull/38406\nhttps://github.com/go-gitea/gitea/pull/38426\nhttps://github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31\nhttps://github.com/go-gitea/gitea/commit/f69e15afe7496cc62e96dab244629c69eb31a7bf\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.27.0\n","enisa_id":"EUVD-2026-58125\n","aliases":"CVE-2026-59763\nGHSA-9mq6-mqjj-c2c5\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9489608e-55ce-3c33-b049-1e6ebcbcdc9d","vulnerability":{"id":"CVE-2026-59763","description":"Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads","datePublished":"Aug 13, 2026, 4:44:58 PM","dateUpdated":"Aug 13, 2026, 6:49:48 PM","status":"PUBLISHED","baseScore":4.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5\nhttps://github.com/go-gitea/gitea/releases/tag/v1.27.0\nhttps://blog.gitea.com/gitea-1.27.0-is-released/\n","enisa_id":"EUVD-2026-58125\n","assigner":"Gitea","epss":0.29,"dataProcessed":"Nov 1, 2026, 7:18:17 AM","vulnerabilityProduct":[{"id":"815b94a6-f409-39b3-9916-3cbac988cc3c","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.4"}],"vulnerabilityVendor":[{"id":"1fb6b576-4dc1-336e-b43e-93f3afa8e87f","vendor":{"name":"Gitea"}}]}}],"enisaIdAdvisory":[]}