CVE-2025-64719 gogs CVE debrief

Who should care

Defenders responsible for Gogs instances should assess exposure and apply the patch to prevent potential denial of service attacks. Defenders should prioritize verifying exposure and applying the patch to prevent potential denial of service attacks against Gogs instances. The vulnerability can be triggered by a malicious user with rights to create a new file on a repository or wiki page, rendering the web interface unusable for the repository or wiki.

Why it matters

Defenders should prioritize verifying exposure and applying the patch to prevent potential denial of service attacks against Gogs instances. The vulnerability can be triggered by a malicious user with rights to create a new file on a repository or wiki page, rendering the web interface unusable.

• Potential denial of service attacks against Gogs instances.
• Unavailability of the web interface for repositories or wikis.

Technical summary

A malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki. The issue is present in file internal/route/repo/wiki.go and internal/route/repo/view.go where the pages try to recover commit information. If errors are returned while recovering commit information, the page will return a 500 error and stop rendering, resulting in a denial of service. This vulnerability is fixed in 0.14.3.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch to prevent potential denial of service attacks.

Recommended defensive actions

• Verify exposure by checking if the Gogs instance is running a version prior to 0.14.3.
• Apply the patch by upgrading to version 0.14.3 or later.
• Monitor for potential denial of service attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is present in file internal/route/repo/wiki.go and internal/route/repo/view.go. The issue is fixed in version 0.14.3. The vulnerability can be triggered by a malicious user with rights to create a new file on a repository or wiki page, rendering the web interface unusable for the repository or wiki. Defenders should verify exposure and apply the patch to prevent potential denial of service attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.