The vulnerability in Gogs allows a user with permission to create files in a repository or wiki to trigger a denial of service. When such a file is added, the server attempts to recover commit information for the listing pages. If the recovery fails, the page returns an HTTP 500 error and the web interface for that repository or wiki becomes unusable. The weakness is identified as improper input validation (CWE-20).

The affected product is Gogs, an open‑source self‑hosted Git service. Versions prior to 0.14.3 are vulnerable. Any instance hosting repositories or wiki pages where untrusted users have write access is at risk, as the DoS can be targeted to a specific repository or wiki.

The CVSS score of 4.9 indicates a moderate severity. The EPSS score is not available, but the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a user with rights to create a new file; thus local or authorized users can trigger the denial. Because the impact is limited to a single repository or wiki, the overall risk is moderate, but it can effectively disrupt service for affected users or teams.