CVE-2026-52814
Received Received - Intake
BaseFortify

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: GitHub, Inc.

Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs built-in Go SSH server is vulnerable to an unauthenticated, asymmetric Denial of Service (DoS) attack. The application accepts inbound TCP connections and passes them to golang.org/x/crypto/ssh.NewServerConn inside a new goroutine without enforcing any read/write deadlines on the underlying net.Conn. An unauthenticated attacker can open multiple TCP connections to the SSH port and simply withhold the SSH protocol banner. This forces the server to spawn an unbounded number of goroutines that block indefinitely waiting for socket I/O. This leads to complete File Descriptor (FD) exhaustion, preventing legitimate users from accessing the Git SSH service, and ultimately destabilizing the entire Gogs process (e.g., causing internal log rotation failures). This vulnerability is fixed in 0.14.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-52814
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
gogs gogs to 0.14.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability affects Gogs, an open source self-hosted Git service, specifically versions prior to 0.14.3. The built-in Go SSH server in Gogs does not enforce read/write deadlines on incoming TCP connections. An unauthenticated attacker can exploit this by opening multiple TCP connections to the SSH port and withholding the SSH protocol banner. This causes the server to spawn an unlimited number of goroutines that wait indefinitely for socket input/output, leading to resource exhaustion.

As a result, the server runs out of file descriptors, which prevents legitimate users from accessing the Git SSH service and can destabilize the entire Gogs process, including causing failures in internal operations like log rotation.

This issue is classified as an asymmetric Denial of Service (DoS) attack and was fixed in version 0.14.3 of Gogs.

Impact Analysis

This vulnerability can impact you by causing a Denial of Service on your Gogs Git SSH service. An attacker can exhaust server resources by opening many TCP connections without completing the SSH handshake, which leads to the server running out of file descriptors.

As a consequence, legitimate users will be unable to access the Git SSH service, disrupting development workflows and potentially causing instability in the Gogs application, including failures in internal processes such as log rotation.

Mitigation Strategies

To mitigate this vulnerability, upgrade Gogs to version 0.14.3 or later where the issue is fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52814. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart