CVE-2026-63021 Gitea Swift package manifest memory exhaustion
An authenticated user can cause memory exhaustion and service termination in Gitea by uploading a highly compressed archive with many Swift package manifests.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63021?
CVE-2026-63021 is a medium-severity denial of service vulnerability in Gitea, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory. An authenticated user with package-publish permission can upload a highly compressed archive containing many manifests, causing allocations far larger than the uploaded archive. This can exhaust memory, terminate the process, or cause request failures.
Weakness: CWE-400
Which versions are affected by CVE-2026-63021?
How do I fix CVE-2026-63021?
No fix has been published for CVE-2026-63021 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-63021 being exploited?
There is no known exploitation of CVE-2026-63021 in the wild and no public exploit code.
Sources
Also known as GHSA-fqxf-w92m-prvq.