CVE-2025-64719 json
Gogs: Denial of Service in repository/wiki file listing web pages
published 2026-06-22 4 mo ago modified 2026-10-12 27 d ago also EUVD-2025-210329 , GHSA-3qq3-668m-v9mj , GO-2026-5098
- cvss
- 4.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki. The issue is present in file internal/route/repo/wiki.go and internal/route/repo/view.go where the pages try to recover commit information. If errors are returned while recovering commit information, the page will return a 500 error and stop rendering, resulting in a denial of service. This vulnerability is fixed in 0.14.3.
Patch / fix
- go gogs.io/gogs 0.14.3
- gogs gogs 0.14.3
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
- github.com/gogs/gogs@ae41bab commit
- github.com/gogs/gogs#8116 pull request
- github.com/gogs/gogs/releases/tag/v0.14.3 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | gogs.io/gogs | <0.14.3 all versions |
0.14.3 |
Affected products
- gogs gogs
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
github.com
/gogs/gogs/pull/8116
web
-
github.com
/gogs/gogs/commit/ae41bab5f28e4880edcef01c91d2cbb8839ec9e4
web
-
github.com
/gogs/gogs/security/advisories/GHSA-3qq3-668m-v9mj
web, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-64719
advisory
-
github.com
/gogs/gogs
package
-
github.com
/gogs/gogs/releases/tag/v0.14.3
web
Sources
- CVE List CVE-2025-64719
- GitHub Advisory GHSA-3qq3-668m-v9mj
- NVD CVE-2025-64719
- OSV GO-2026-5098
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.