CVE-2026-22592: 
Gogs vulnerability analysis and mitigation

CVE-2026-22592 is a Denial of Service (DoS) vulnerability in Gogs, an open-source self-hosted Git service, affecting versions 0.13.3 and prior. An authenticated user can crash the application by deleting a repository file before a mirror synchronization occurs, triggering a null pointer dereference in the mirror sync logic. The vulnerability was disclosed on February 6, 2026, and has a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Gogs Advisory).

The root cause is a null pointer dereference in gogs/internal/database/mirror.go. When GetMirrorByRepoID fails (e.g., because the repository no longer exists), the returned mirror object m is nil, but the error-handling code at lines 333–337 attempts to dereference m.RepoID in the log statement before checking the error condition, causing a crash. This is classified under CWE-862 (Missing Authorization), as the application does not adequately validate the state of the resource before proceeding with the synchronization operation. A public proof-of-concept Python script is available that spams the mirror-sync action on a repository while concurrently deleting it, reliably triggering the crash (Gogs Advisory, GitHub Advisory).

Successful exploitation results in a complete crash of the Gogs application, causing full unavailability of the self-hosted Git service for all users. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Any authenticated user with low privileges can repeatedly trigger this condition, making recovery difficult without patching (Gogs Advisory).

A public proof-of-concept exploit is available in the official GitHub security advisory, consisting of a simple Python script that repeatedly triggers mirror-sync requests while deleting the target repository. The attack requires only a low-privilege authenticated account and has low complexity. The EPSS score is approximately 0.036% (0.022% per GitHub Advisory), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Gogs Advisory).

1. Obtain authenticated access: Log in to a vulnerable Gogs instance (version ≤ 0.13.3) with any user-level account that has access to a mirrored repository.
2. Identify a mirror repository: Locate or create a repository configured as a mirror, noting its settings URL (e.g., http://<gogs-host>:3000/<user>/<repo>/settings).
3. Extract CSRF token: Retrieve a valid _csrf token from the repository settings page, required for POST requests.
4. Spam mirror-sync requests: Using the public PoC script, send repeated POST requests to the repository settings endpoint with action=mirror-sync in the body while authenticated via session cookie.
5. Delete the repository: Concurrently delete the target repository (via the UI or API) so that GetMirrorByRepoID returns an error with a nil mirror object.
6. Trigger crash: The next mirror-sync processing cycle attempts to log m.RepoID on a nil pointer, causing a panic and crashing the Gogs application (Gogs Advisory).

• Logs: Gogs application logs showing a Go panic or nil pointer dereference originating from internal/database/mirror.go around lines 333–337; repeated mirror-sync POST requests from the same authenticated session in a short time window.
• Network: High-frequency POST requests to /<user>/<repo>/settings with action=mirror-sync in the request body from a single source IP.
• Process: Unexpected termination or restart of the Gogs process; crash dumps or core files generated by the Gogs service account.
• Application: Sudden unavailability of the Gogs web interface coinciding with repository deletion events in audit logs (Gogs Advisory).

Upgrade Gogs to version 0.13.4 or 0.14.0+dev, which contain the fix for this vulnerability (commit 961a79e). As a temporary workaround, restrict repository mirror-sync permissions to trusted users only and monitor for suspicious file deletions in repositories. Rate-limiting POST requests to repository settings endpoints can also reduce the risk of exploitation until patching is possible (Gogs Advisory, GitHub Advisory).

Coverage of this vulnerability has been limited to automated vulnerability tracking platforms and security news aggregators. A brief write-up was published at infinitsec.net shortly after disclosure, and the vulnerability was tracked by Red Hat's CVE database and Linux security advisories (SUSE govulncheck). No notable researcher commentary or significant community discussion has been identified beyond standard advisory republication (GitHub Advisory).