CVE-2026-52796

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description A specially crafted issue index pattern can cause a panic during rendering, leading to a denial of service. In the internal/markup/markup.go file, the RenderIssueIndexPattern() function uses com.Expand to render the pattern into a link. If the configured pattern contains an opening brace { without a corresponding closing brace }, the strings.Index() function returns -1, causing a slice operation template[:-1] that triggers a panic. Consequently, any page within the affected repository containing an issue index reference, such as #1, becomes unavailable.

Recommendations Update to version 0.14.3.