---
id: "CVE-2026-117677"
kind: "vulnerability"
aliases: ["CVE-2026-117677"]
title: "Gitea: Helm chart upload can exhaust server CPU via decompression"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gitea", "helm", "package", "package-registry", "self-hosted"]
not_affected_if: ["managed-hosting", "no-helm-packages", "registration-closed"]
published_at: "2026-11-01T10:18:35+00:00"
first_seen_at: "2026-11-01T10:49:33+00:00"
updated_at: "2026-11-01T10:51:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117677", "first_seen_at": "2026-11-01T10:49:33+00:00"}]
---

# Gitea: Helm chart upload can exhaust server CPU via decompression

Gitea decompresses uploaded Helm chart archives without a size limit before checking the package quota, which only counts the compressed size. A user with package write access can upload small, highly compressed archives that force heavy CPU use, slowing or degrading the instance; the sources state it does not allow code execution or data access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Gitea version with `gitea --version` or the admin dashboard and compare it to the fixed version (unknown in sources).
- Confirm whether the Gitea instance has the Helm package registry in use and whether open registration is enabled.

## Timeline

- 2026-11-01T10:49:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117677

## From the sources

When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed size, and did so before the package size quota was checked; the quota only considers the compressed upload size. A user with package write access to an owner, for example their own account on an instance with open registration, could repeatedly upload small, highly compressed archives that make the server spend CPU time proportional to the decompressed size, degrading the availability of the Gitea instance. The issue does not allow code execution or data access.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_