CVE-2026-52814 Details

A denial-of-service vulnerability has been identified in Gogs, an open-source self-hosted Git service, prior to version 0.14.3. The issue arises in the built-in Go SSH server, which allows for an unauthenticated, asymmetric denial-of-service attack. The vulnerability occurs because the application accepts inbound TCP connections and forwards them to 'golang.org/x/crypto/ssh.NewServerConn' in a new goroutine, without applying any read or write deadlines on the underlying 'net.Conn'. An unauthenticated attacker can exploit this by opening multiple TCP connections to the SSH port and withholding the SSH protocol banner, causing the server to create an unbounded number of goroutines that block indefinitely, waiting for data. This exploitation leads to complete file descriptor exhaustion, disrupting access to the Git SSH service for legitimate users and destabilizing the entire Gogs process, potentially causing internal log rotation failures.

Users can upgrade to Gogs version 0.14.3 or later, where this vulnerability has been fixed.