CVE-2026-59763Published
Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-59763 · Microsoft / collected KEV context
cve-program · CVE-2026-59763
- https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5
- https://github.com/go-gitea/gitea/releases/tag/v1.27.0
- https://blog.gitea.com/gitea-1.27.0-is-released/
euvd · EUVD-2026-58125
- https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5
- https://github.com/go-gitea/gitea/releases/tag/v1.27.0
- https://blog.gitea.com/gitea-1.27.0-is-released/
nvd · CVE-2026-59763
- https://blog.gitea.com/gitea-1.27.0-is-released/
- https://github.com/go-gitea/gitea/releases/tag/v1.27.0
- https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5
osv · GHSA-9mq6-mqjj-c2c5
- https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5
- https://github.com/go-gitea/gitea/pull/38406
- https://github.com/go-gitea/gitea/pull/38426
- https://github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31
- https://github.com/go-gitea/gitea/commit/f69e15afe7496cc62e96dab244629c69eb31a7bf
- https://github.com/go-gitea/gitea
- https://github.com/go-gitea/gitea/releases/tag/v1.27.0
osv · GO-2026-6049
- https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5
- https://github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31
- https://github.com/go-gitea/gitea/commit/f69e15afe7496cc62e96dab244629c69eb31a7bf
- https://github.com/go-gitea/gitea/pull/38406
- https://github.com/go-gitea/gitea/pull/38426
- https://github.com/go-gitea/gitea/releases/tag/v1.27.0
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.