Gogs Denial-of-Service Vulnerability in Repository Mirror Synchronization

A denial-of-service vulnerability has been identified in Gogs, an open-source self-hosted Git service, in versions through 0.13.3. The issue arises when an authenticated user deletes a repository file before synchronization, causing the application to crash. This vulnerability has been patched in versions 0.13.4 and 0.14.0+dev.

Impact

Exploitation of this vulnerability leads to a server crash, causing a denial-of-service condition.

Reproduction

To reproduce this vulnerability, initiate a mirror synchronization on a repository and then delete that repository before the synchronization process completes. This will cause the application to crash.

Remediation

Users can upgrade to Gogs versions 0.13.4 or 0.14.0+dev to address this vulnerability.