CVE-2026-52814

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description The built-in Go SSH server is susceptible to an unauthenticated, asymmetric Denial of Service (DoS) attack. The application accepts inbound TCP connections and passes them to the NewServerConn() function within a new goroutine without enforcing read/write deadlines on the underlying net.Conn variable. An attacker can open numerous TCP connections to the SSH port and withhold the SSH protocol banner, forcing the server to spawn an unbounded number of goroutines that block indefinitely while waiting for socket I/O. This results in complete File Descriptor (FD) exhaustion, which prevents legitimate users from accessing the Git SSH service and can destabilize the entire process, leading to issues such as internal log rotation failures. The issue occurs because the listen() function in internal/ssh/ssh.go fails to call SetDeadline(), causing the process to block forever on the kernel TCP socket during the cryptographic handshake.

Recommendations Update Gogs to version 0.14.3. As a temporary mitigation, restrict access to the SSH port to minimize the risk of exploitation.