Denial of Service in Gogs: Self-hosted Git Service Vulnerability

CVE-2025-64719

What is CVE-2025-64719?

A vulnerability exists in Gogs, an open-source self-hosted Git service, where a malicious user with permissions to create files can exploit the system, leading to a denial of service. Specifically, when attempting to retrieve commit information from repositories or wiki pages, the system can return an HTTP error 500, causing the web interface to become unresponsive. This issue is located in the internal routes handling file for repositories and wikis, where failure in recovering commit details results in service interruptions. The vulnerability has been addressed in version 0.14.3.

References