IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-08-13 17:17

MODIFIED

2026-08-13 17:17

EPSS (Prob. Exploit)

0.29%

Top 78.5%

DATA SOURCES:

NVD 🔗 2026-08-13 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 GITHUB 🔗 2026-10-29 OSV 🔗 2026-10-26

> DESCRIPTION

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-284

> CWE DETAILED DESCRIPTIONS

CWE-284: Improper Access Control - The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

> GITHUB SECURITY ADVISORY

GHSA-9mq6-mqjj-c2c5 MODERATE

Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

AFFECTED PACKAGES:

GO / code.gitea.io/gitea

< 1.27.0

Fixed in: 1.27.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

AFFECTED PACKAGES:

Unknown / Unknown

38 versions affected

ALIASES:

GHSA-9mq6-mqjj-c2c5, GO-2026-6049

> HISTORIQUE DES MODIFICATIONS

Première apparition

13/08/2026 17:17

Source: NVD

📊 ENRICHISSEMENT 01/09/2026 06:02

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-284: Improper Access Control - The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Total des modifications: 1 Dernière mise à jour: 2 months ago

> REFERENCES

https://blog.gitea.com/gitea-1.27.0-is-released/

https://github.com/go-gitea/gitea/releases/tag/v1.27.0

https://github.com/go-gitea/gitea/security/advisories/GHSA-9mq6-mqjj-c2c5