CVE-2025-64719

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki. The issue is present in file internal/route/repo/wiki.go and internal/route/repo/view.go where the pages try to recover commit information. If errors are returned while recovering commit information, the page will return a 500 error and stop rendering, resulting in a denial of service. This vulnerability is fixed in 0.14.3.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/gogs/gogs/security/advisories/GHSA-3qq3-668m-v9mj

Configurations

No configuration.

History

05 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Gogs es un servicio Git autoalojado de código abierto. Anteriormente a la 0.14.3, un usuario malicioso con derechos para crear un nuevo archivo en un repositorio o página wiki puede desencadenar una condición de denegación de servicio en la que las páginas que contienen el listado de archivos devolverán el error HTTP 500 y harán que la interfaz web sea inutilizable para el repositorio o la wiki. El problema está presente en los archivos internal/route/repo/wiki.go e internal/route/repo/view.go, donde las páginas intentan recuperar información de commit. Si se devuelven errores mientras se recupera la información de commit, la página devolverá un error 500 y dejará de renderizarse, lo que resultará en una denegación de servicio. Esta vulnerabilidad se ha corregido en la versión 0.14.3.

Information

Published : 2026-06-24 21:16

Updated : 2026-10-12 21:10

NVD link : CVE-2025-64719

Mitre link : CVE-2025-64719

CVE.ORG link : CVE-2025-64719

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-64719", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64719", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T20:05:48.807800Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gogs", "product": "gogs", "versions": [{"status": "affected", "version": "< 0.14.3"}]}]}], "published": "2026-06-24T21:16:52.007", "references": [{"url": "https://github.com/gogs/gogs/security/advisories/GHSA-3qq3-668m-v9mj", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki. The issue is present in file internal/route/repo/wiki.go and internal/route/repo/view.go where the pages try to recover commit information. If errors are returned while recovering commit information, the page will return a 500 error and stop rendering, resulting in a denial of service. This vulnerability is fixed in 0.14.3."}, {"lang": "es", "value": "Gogs es un servicio Git autoalojado de c\u00f3digo abierto. Anteriormente a la 0.14.3, un usuario malicioso con derechos para crear un nuevo archivo en un repositorio o p\u00e1gina wiki puede desencadenar una condici\u00f3n de denegaci\u00f3n de servicio en la que las p\u00e1ginas que contienen el listado de archivos devolver\u00e1n el error HTTP 500 y har\u00e1n que la interfaz web sea inutilizable para el repositorio o la wiki. El problema est\u00e1 presente en los archivos internal/route/repo/wiki.go e internal/route/repo/view.go, donde las p\u00e1ginas intentan recuperar informaci\u00f3n de commit. Si se devuelven errores mientras se recupera la informaci\u00f3n de commit, la p\u00e1gina devolver\u00e1 un error 500 y dejar\u00e1 de renderizarse, lo que resultar\u00e1 en una denegaci\u00f3n de servicio. Esta vulnerabilidad se ha corregido en la versi\u00f3n 0.14.3."}], "lastModified": "2026-10-12T21:10:00.227", "sourceIdentifier": "security-advisories@github.com"}