{"id":"CVE-2026-117677","kind":"vulnerability","aliases":["CVE-2026-117677"],"related":[],"title":"Gitea: Helm chart upload can exhaust server CPU via decompression","description":"When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write access to an owner, for example their own account on an instance with open registration, could repeatedly upload small, highly compressed archives that make the server spend CPU time proportional to the decompressed size, degrading the availability of the Gitea instance. The issue does not allow code execution or data access.","summary":"Gitea decompresses uploaded Helm chart archives without a size limit before checking the package quota, which only counts the compressed size. A user with package write access can upload small, highly compressed archives that force heavy CPU use, slowing or degrading the instance; the sources state it does not allow code execution or data access.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gitea","helm","package","package-registry","self-hosted"],"not_affected_if":["managed-hosting","no-helm-packages","registration-closed"],"how_to_check":"- Check the installed Gitea version with `gitea --version` or the admin dashboard and compare it to the fixed version (unknown in sources).\n- Confirm whether the Gitea instance has the Helm package registry in use and whether open registration is enabled.","fix":null,"status":"open","published_at":"2026-11-01T10:18:35+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","triaged_at":"2026-11-01T10:51:33+00:00","updated_at":"2026-11-01T10:51:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-01T10:51:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Gitea: Helm chart upload can exhaust server CPU via decompression","impact":"low","summary":"Gitea decompresses uploaded Helm chart archives without a size limit before checking the package quota, which only counts the compressed size. A user with package write access can upload small, highly compressed archives that force heavy CPU use, slowing or degrading the instance; the sources state it does not allow code execution or data access.","audience":"businesses","category":"package","nicknames":[],"who_cares":["gitea","self-hosted","helm","package-registry"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Gitea server slows or becomes unavailable from repeated CPU-heavy uploads","analyst_note":"Find the fixed Gitea version and the advisory URL; the NVD entry gives no product ranges or patched release.","how_to_check":"- Check the installed Gitea version with `gitea --version` or the admin dashboard and compare it to the fixed version (unknown in sources).\n- Confirm whether the Gitea instance has the Helm package registry in use and whether open registration is enabled.","plain_action":"","needs_analyst":true,"not_affected_if":["no-helm-packages","registration-closed","managed-hosting"],"who_is_affected":"Teams running a self-hosted Gitea instance that serves the packages registry and accepts Helm chart uploads. Exposure is greater where registration is open or many users have package write access to an owner; instances that do not use the Helm package type or restrict uploads can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000709,"input_tokens":4194,"output_tokens":579,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117677':13A,16A '-2026':12A,15A 'access':52B,80B,128C,178C 'account':136C 'allow':75B,173C 'archiv':31B,58B,90C,149C 'avail':164C 'chart':3A,30B,86C 'chart.yaml':99C 'check':37B,114C 'code':76B,174C 'compress':45B,57B,120C,148C 'consid':118C 'could':143C 'count':43B 'cpu':8A,62B,155C 'cve':11A,14A 'data':79B,177C 'decompress':10A,27B,88C,103C,160C 'degrad':66B,162C 'entri':95C 'everi':93C 'exampl':133C 'execut':77B,175C 'exhaust':6A 'forc':60B 'gitea':1A,17B,26B,87C,167C 'heavi':61B 'helm':2A,18B,29B,85C 'high':56B,147C 'host':25B 'instanc':68B,139C,168C 'issu':170C 'limit':35B,101C 'look':97C 'make':151C 'open':141C 'owner':131C 'packag':19B,21B,39B,50B,110C,126C 'package-registri':20B 'pars':82C 'proport':157C 'quota':40B,112C,116C 'read':92C 'registr':142C 'registri':22B 'repeat':144C 'self':24B 'self-host':23B 'server':7A,153C 'size':34B,46B,104C,111C,122C,161C 'slow':64B 'small':55B,146C 'sourc':70B 'spend':154C 'state':71B 'tar':94C 'time':156C 'upload':4A,28B,54B,84C,121C,145C 'use':63B 'user':48B,124C 'via':9A 'without':32B,100C 'write':51B,127C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Gitea instance that serves the packages registry and accepts Helm chart uploads. Exposure is greater where registration is open or many users have package write access to an owner; instances that do not use the Helm package type or restrict uploads can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T10:18:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117677","severity":null,"published_at":"2026-11-01T10:18:35+00:00","modified_at":"2026-11-01T10:18:35+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","fetched_at":"2026-11-01T10:49:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}