---
id: 9157
title: "CVE-2026-42931: DoS via Unbounded Request Body Read in Gitea’s npm Endpoint"
cve: CVE-2026-42931
source_domain: yokai.hakaisecurity.io
source_url: "https://yokai.hakaisecurity.io/cve-2026-42931-dos-via-unbounded-request-body-read-in-giteas-npm-endpoint/"
published_at: "2026-08-14T20:43:59Z"
tags: ["vulnerability-research", "research", "dos"]
phying_url: "https://phying.com/item/9157"
lang: en
---

# CVE-2026-42931: DoS via Unbounded Request Body Read in Gitea’s npm Endpoint

## Summary

Abstract How much memory should a small request intended to change a package’s tag consume? Under normal conditions, just a few bytes. After all, the endpoint analyzed in this article expects to receive only a string containing the version of an NPM package, such as "1.0.0". However, during analysis of Gitea’s Package Registry, a behavior […]

## Intelligence Metadata

- **Sources:** yokai.hakaisecurity.io
- **CVE:** CVE-2026-42931
- **Published:** 2026-08-14T20:43:59Z
- **Original:** https://yokai.hakaisecurity.io/cve-2026-42931-dos-via-unbounded-request-body-read-in-giteas-npm-endpoint/
- **Phying News:** https://phying.com/item/9157