CVE-2026-73130

MediumCVSS 4.3/10Last modified Oct 14, 2026

Description

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can submit an oversized value to amplify template reads and memory use, impairing availability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2026
Last modified
Oct 14, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-731355.3Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whCVE-2026-731367.5Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfeCVE-2026-731377.7A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmReleasCVE-2026-73147.3A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0. This affects the function get_doc_path of the file src/spire_doc_mcp/apCVE-2026-731405.3Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normCVE-2026-73157.3A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1. This impacts the function get_pdf_path of the file src/spire_pdf_mcp/server.pyCVE-2026-731555.3Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether thoCVE-2026-731565.3Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. SCVE-2026-731572.3Affected versions of cti-transmute render data obtained from a remote MISP instance into the event-browser interface using HTML interpolatioCVE-2026-731585.1Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style propertiesCVE-2026-731595.1Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mCVE-2026-73167.3A vulnerability has been found in eiliyaabedini aider-mcp up to 667b914301aada695aab0e46d1fb3a7d5e32c8af. Affected is an unknown function of