CVE record · 1 source
CVE-2026-117677
When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the…
- Vendor
- Gitea
- Product
- Gitea
- Weakness
- CWE-400, CWE-409
- Exposure class
- Developer platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the…
When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for `Chart.yaml` without limiting the decompressed size, and did so before the package size quota was checked; the quota…