CVE-2026-52796: Gogs Denial of Service via Malformed Issue Index Patterns

Technical summary

The vulnerability exists in internal/markup/markup.go within the RenderIssueIndexPattern function. The code uses com.Expand to process issue index patterns without validating bracket matching. Specifically, when a configured pattern contains an unmatched opening brace, strings.Index(template, "}") returns -1, causing the subsequent slice operation template[:-1] to access an invalid index and trigger a runtime panic. The issue is exposed to any authenticated user viewing repository pages that reference issues, making it a user-triggerable denial of service once the malformed pattern is configured. Gogs 0.14.3 and later address this by implementing proper input validation or safe string handling in pattern expansion.

Business impact

Repository administrators who have configured custom issue index patterns face operational disruption. A misconfigured pattern—even inadvertently—renders an entire repository inaccessible when users attempt to view pages with issue references. This disrupts team collaboration, issue tracking workflows, and repository browsing. The impact is scoped to the repository with the malformed pattern and requires an authenticated user to access a page containing an issue reference to trigger the crash. Recovery requires either reverting the pattern configuration or upgrading Gogs, creating temporary downtime for affected teams.

Affected systems

Gogs versions prior to 0.14.3 are affected. The vulnerability is only exploitable if a repository administrator has configured a custom issue index pattern containing unmatched braces. Self-hosted Gogs instances are the primary concern; the vulnerability does not affect hosted Gogs services unless administrators have made the relevant misconfiguration. The scope is limited to repositories where the malformed pattern is active.

Exploitability

Exploitability is low and requires specific conditions: an authenticated user must have repository access, and a misconfigured issue pattern must already be in place. The crash is triggered passively by viewing any page with an issue reference (e.g., #1). No special tools, privileges, or user interaction beyond normal repository access is needed once the pattern exists. However, the pattern must be deliberately or accidentally misconfigured by an administrator; external attackers cannot inject patterns remotely. The CVSS score of 3.5 reflects the requirement for authentication and the limited scope of impact.

Remediation

Upgrade Gogs to version 0.14.3 or later, which includes fixes for unsafe pattern expansion. Administrators running earlier versions should also audit their repository issue index patterns for unmatched braces and correct any malformed configurations. After upgrading, verify that repository pages render normally and issue references display correctly.

Patch guidance

Apply the upgrade to Gogs 0.14.3 or a later release. The patch addresses the underlying string handling vulnerability in RenderIssueIndexPattern. Administrators should schedule the upgrade during a maintenance window to avoid repository downtime. No configuration changes are required post-patch if patterns were already configured; the fix hardens the code against malformed input. Verify the upgrade by accessing repositories and confirming that pages with issue references render without errors.

Detection guidance

Monitor Gogs logs for panic errors or crashes related to issue pattern rendering. Error messages referencing internal/markup/markup.go or RenderIssueIndexPattern indicate exploitation. Additionally, audit repository configurations to identify any issue index patterns containing unmatched braces. Repositories with such patterns are at immediate risk if accessed by authenticated users. Gogs administrators can review pattern configurations in the repository settings or administration panel.

Why prioritize this

While the CVSS score is low, this vulnerability should be addressed promptly because it creates immediate operational impact—affected repositories become completely unavailable when users attempt normal browsing. The fix is straightforward (an upgrade), and the misconfiguration required to trigger the issue is detectable and correctable. Prioritize based on whether your Gogs deployment uses custom issue patterns and whether repository availability is critical to your operations.

Risk score, explained

The CVSS 3.1 score of 3.5 (LOW) reflects several factors: authentication is required (PR:L), the attack vector is network-based (AV:N) but relies on user interaction (UI:R), and the impact is limited to availability (A:L) with no confidentiality or integrity compromise (C:N/I:N). The scope is unchanged (S:U), meaning the impact is confined to the vulnerable service. The score appropriately captures that while the denial of service is real, it requires both misconfiguration and authenticated access to trigger, limiting widespread exploitability.

Frequently asked questions