« Volver al listado

CVE-2026-22592

Estado: AnalizadaMedia (6.5)—

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, an authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Gogs — Gogs

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-22592",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22592",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-06T18:55:12.756594Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "gogs",
          "product": "gogs",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.14.0+dev"
            },
            {
              "status": "affected",
              "version": "< 0.13.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-06T18:15:56.357",
  "references": [
    {
      "url": "https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, an authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash. This issue has been patched in versions 0.13.4 and 0.14.0+dev."
    },
    {
      "lang": "es",
      "value": "Gogs es un servicio Git autoalojado de código abierto. En la versión 0.13.3 y anteriores, un usuario autenticado puede causar un ataque DoS. Si uno de los archivos del repositorio se elimina antes de la sincronización, hará que la aplicación falle. Este problema ha sido parcheado en las versiones 0.13.4 y 0.14.0+dev."
    }
  ],
  "lastModified": "2026-06-17T10:20:07.550",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "674F0DE0-7669-4B02-B45E-DD60FB5D462F",
              "versionEndExcluding": "0.13.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}