Gogs allows repository owners to configure an issue index pattern that is displayed for issue references. A malformed pattern that begins with an opening brace but lacks a closing brace causes the internal rendering routine to panic. When a user visits any page containing an issue reference, the application crashes and becomes unavailable, effectively denying service for that repository.

The vulnerability affects the Gogs open‑source self‑hosted Git service version 0.14.2 and earlier. Versions 0.14.3 and later contain the fix.

The CVSS score of 3.5 indicates a low to moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting limited active exploitation. The attack requires the ability to modify the repository configuration to insert the malicious pattern, which would typically be an authenticated user with administrative rights. Once the flag is set, any issue reference triggers a crash, resulting in an immediate denial of service for all visitors to the affected pages.