Denial of service via decompression bomb and O(N²) concatenation in Gitea Debian package parser (CVE-2026-56755)

Gitea's Debian package registry parser decompresses control.tar.gz without any size limit, allowing a crafted 83 MB .deb file to expand to over 16 GB in memory during parsing. A second independent flaw concatenates Description continuation lines with += in a loop, producing O(N²) allocation and CPU work. Any authenticated user with write access to the package registry can trigger complete server denial of service with a single upload request. Affected versions: - <= 1.26.4 We recommend updating to: 1.27.0. CVSS ? · our assessment: this_week Reference: https://github.com/go-gitea/gitea/security/advisories/GHSA-6hm7-3pwj-22rm Details: https://vuln.today/cve/CVE-2026-56755