6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22592

CVE-2026-22592: Gogs is Vulnerable to Denial of Service

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, an authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22592

CVE-2026-22592:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	<= 0.13.3	0.13.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service (DoS) that can be triggered by an authenticated user due to a race condition between repository deletion and mirror synchronization. The analysis identified two key functions involved in the exploit chain.

First, a missing authorization vulnerability (GHSA-cr88-6mqm-4g57) allowed non-owner authenticated users to delete a repository via the API. The function repo.Delete is the handler for this operation. The provided patch, 961a79e8f9f2b3190ea804bcf635e4b43b123272, rectifies this by enforcing owner-level permissions for the deletion, making the DoS harder to trigger. During an exploit, this function would be called to initiate the vulnerable state.

Second, the core crash occurs within the database.Mirrors.NextSync function. This function runs as part of a background task for repository mirror synchronization. As detailed in the vulnerability description, if a repository is deleted while a sync is pending, this function's call to GetMirrorByRepoID returns a nil object. The function fails to handle this nil return value and attempts to dereference it, causing a panic that crashes the entire Gogs instance. This function is the epicenter of the DoS, and its signature would appear in any crash log or profiler output at the moment of exploitation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.