CVE-2026-22592

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, an authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57	Exploit Vendor Advisory
https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:20

Type	Values Removed	Values Added
Summary		(es) Gogs es un servicio Git autoalojado de código abierto. En la versión 0.13.3 y anteriores, un usuario autenticado puede causar un ataque DoS. Si uno de los archivos del repositorio se elimina antes de la sincronización, hará que la aplicación falle. Este problema ha sido parcheado en las versiones 0.13.4 y 0.14.0+dev.

17 Feb 2026, 21:40

Type	Values Removed	Values Added
References	~~() https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57 -~~	() https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57 - Exploit, Vendor Advisory
CPE		cpe:2.3:a:gogs:gogs::::::::
First Time		Gogs Gogs gogs

06 Feb 2026, 19:16

Type	Values Removed	Values Added
References	~~() https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57 -~~	() https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57 -

06 Feb 2026, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-06 18:15

Updated : 2026-06-17 10:20

NVD link : CVE-2026-22592

Mitre link : CVE-2026-22592

CVE.ORG link : CVE-2026-22592

JSON object : View

Products Affected

gogs

gogs

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-22592", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22592", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-06T18:55:12.756594Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gogs", "product": "gogs", "versions": [{"status": "affected", "version": "< 0.14.0+dev"}, {"status": "affected", "version": "< 0.13.4"}]}]}], "published": "2026-02-06T18:15:56.357", "references": [{"url": "https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, an authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash. This issue has been patched in versions 0.13.4 and 0.14.0+dev."}, {"lang": "es", "value": "Gogs es un servicio Git autoalojado de c\u00f3digo abierto. En la versi\u00f3n 0.13.3 y anteriores, un usuario autenticado puede causar un ataque DoS. Si uno de los archivos del repositorio se elimina antes de la sincronizaci\u00f3n, har\u00e1 que la aplicaci\u00f3n falle. Este problema ha sido parcheado en las versiones 0.13.4 y 0.14.0+dev."}], "lastModified": "2026-06-17T10:20:07.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "674F0DE0-7669-4B02-B45E-DD60FB5D462F", "versionEndExcluding": "0.13.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}