CVE-2025-68971

Description

In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be associated with an issue or a release).

References

https://github.com/ChewKeanHo/research-cve-2025-68971

https://zenodo.org/records/19058493

https://zenodo.org/records/18945481

https://codeberg.org/forgejo/forgejo

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291973

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS