CVE-2026-52796: Gogs DoS Vulnerability in Issue Index Pattern Rendering
Summary
CVE-2026-52796: Gogs has DoS in rendering issue index pattern. Affects gogs.io/gogs versions < 0.14.3. Fixed in 0.14.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service that allows users to manage their Git repositories with ease. It provides features such as issue tracking, pull requests, and a web-based interface for repository management. However, Gogs has a vulnerability related to the rendering of issue index patterns, which can lead to denial of service (DoS) under certain conditions.
Vulnerability Detail
The vulnerability arises from the way Gogs handles the rendering of issue index patterns using the com.Expand function. When a specific template is provided that contains an unmatched '{' character without a corresponding '}', it causes the application to panic. This panic results in parts of the application becoming unavailable, leading to a denial of service for users trying to access those pages. The technical issue is located in the internal/markup/markup.go file, where the code does not properly validate the template before processing it.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.14.3
This is the first release that contains the fix.
go get gogs.io/gogs@v0.14.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using issue index patterns that contain unmatched '{' characters. Ensure that any templates you create are properly formatted and validated before use.
Conclusion
The CVE-2026-52796 vulnerability in Gogs poses a risk of denial of service due to improper handling of issue index patterns. It is crucial for users to update to version 0.14.3 or later to mitigate this risk. Additionally, users can utilize Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for gogs.io/gogs →
FAQ
This vulnerability can lead to a denial of service, making parts of the Gogs application unavailable to users.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Gogs versions up to and including 0.14.2 are affected by this vulnerability.
Yes, the vulnerability has been patched in version 0.14.3 of Gogs.
If you cannot update immediately, ensure that you do not use problematic issue index patterns that could trigger the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
