CVE-2026-52814— Gogs 资源管理错误漏洞

Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)

Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs built-in Go SSH server is vulnerable to an unauthenticated, asymmetric Denial of Service (DoS) attack. The application accepts inbound TCP connections and passes them to golang.org/x/crypto/ssh.NewServerConn inside a new goroutine without enforcing any read/write deadlines on the underlying net.Conn. An unauthenticated attacker can open multiple TCP connections to the SSH port and simply withhold the SSH protocol banner. This forces the server to spawn an unbounded number of goroutines that block indefinitely waiting for socket I/O. This leads to complete File Descriptor (FD) exhaustion, preventing legitimate users from accessing the Git SSH service, and ultimately destabilizing the entire Gogs process (e.g., causing internal log rotation failures). This vulnerability is fixed in 0.14.3.

N/A

未加控制的资源消耗(资源穷尽)

Gogs 资源管理错误漏洞

Gogs是Gogs团队开源的一个源代码管理软件。 Gogs 0.14.3之前版本存在资源管理错误漏洞，该漏洞源于内置Go SSH服务器未对底层网络连接实施读写截止时间，可能导致未经身份验证的攻击者通过打开多个TCP连接并阻止SSH协议横幅，导致文件描述符耗尽，进而引发拒绝服务攻击。

N/A

N/A