5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52814

CVE-2026-52814: Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs built-in Go SSH server is vulnerable to an unauthenticated, asymmetric Denial of Service (DoS) attack. The application accepts inbound TCP connections and passes them to golang.org/x/crypto/ssh.NewServerConn inside a new goroutine without enforcing any read/write deadlines on the underlying net.Conn. An unauthenticated attacker can open multiple TCP connections to the SSH port and simply withhold the SSH protocol banner. This forces the server to spawn an unbounded number of goroutines that block indefinitely waiting for socket I/O. This leads to complete File Descriptor (FD) exhaustion, preventing legitimate users from accessing the Git SSH service, and ultimately destabilizing the entire Gogs process (e.g., causing internal log rotation failures). This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52814

CVE-2026-52814:

5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	< 0.14.3	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the listen function in internal/ssh/ssh.go. Specifically, it's in the anonymous goroutine spawned to handle each new SSH connection. The vulnerability is a classic resource exhaustion attack. The root cause is the lack of a timeout on the initial SSH handshake. An attacker can establish a TCP connection to the SSH port and then do nothing. The server-side goroutine will then block forever in ssh.NewServerConn, waiting for the client's SSH version string. By opening many such connections, an attacker can exhaust the server's file descriptors, preventing legitimate users from connecting and potentially causing other parts of the Gogs service to fail. The patch mitigates this by adding a 15-second deadline to the connection using conn.SetDeadline before the call to ssh.NewServerConn. If the client doesn't start the SSH handshake within that time, the connection is closed. The vulnerable function is identified as listen.func1, which is the anonymous goroutine within the listen function, as this is where the blocking call occurs.

Vulnerable functions

listen.func1

internal/ssh/ssh.go

The vulnerability exists in an anonymous goroutine function within the `listen` function. This function handles new SSH connections. Before the patch, it called `ssh.NewServerConn` without setting a deadline on the connection. This allowed an attacker to open a connection and not send any data, causing the goroutine to block indefinitely, leading to a denial of service through resource exhaustion (file descriptors and memory). The patch adds a 15-second deadline to the connection before the handshake, mitigating the vulnerability

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.