What is the CVSS score of CVE-2025-68971?

CVE-2025-68971 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Forgejo are affected by CVE-2025-68971?

Organizations using Forgejo should be aware of notable risk from CVE-2025-68971, a resource exhaustion vulnerability rated CVSS 6.5. Service availability could be impacted.

How to fix or mitigate CVE-2025-68971?

Within 30 days: Identify affected systems running Forgejo and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Forgejo CVE-2025-68971

MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-03-16 mitre

Denial Of Service N A

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network upload path (AV:N), no complexity (AC:L), requires authenticated account (PR:L), no confidentiality or integrity impact, only availability exhaustion (A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 16, 2026 - 20:05 vuln.today

CVE Published

Mar 16, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be associated with an issue or a release).

AnalysisAI

Denial of service in Forgejo through 13.0.3 allows any authenticated user to exhaust server resources by uploading multi-gigabyte file attachments to issues or releases. The attachment component imposes no meaningful size restriction, enabling resource exhaustion via disk space consumption. No active exploitation has been identified and no confirmed patch version is available in referenced data; EPSS sits at the 4th percentile, suggesting negligible observed exploitation pressure.

Technical ContextAI

Forgejo is a self-hosted Git forge and a community-driven fork of Gitea, providing repository hosting, issue tracking, and release management. The affected component is the file attachment upload handler, which accepts arbitrarily large files when users attach assets to issues or release packages. The root cause maps to CWE-400 (Uncontrolled Resource Consumption): the application fails to enforce upload size limits at the application layer, allowing a low-privileged user to drive uncontrolled disk or temporary storage consumption. The NVD CPE entry (cpe:2.3:a:n/a:n/a:*) is a generic placeholder, indicating formal CPE assignment for Forgejo has not yet been completed, but the affected product and version ceiling (13.0.3) are stated in the CVE description. Relevant tracking exists in the FreeBSD bug tracker and Zenodo research records.

RemediationAI

No vendor-released patch version has been independently confirmed in the available reference data at time of analysis - the CVE description covers all Forgejo releases through 13.0.3. Consumers should monitor the upstream repository at https://codeberg.org/forgejo/forgejo and the Zenodo records (https://zenodo.org/records/18945481, https://zenodo.org/records/19058493) for patch availability. As an immediate compensating control, administrators should configure their reverse proxy to cap upload body size - for nginx, set client_max_body_size to a reasonable limit (e.g., 100m); for Apache, use LimitRequestBody. This prevents abuse but may require tuning if legitimate large release binaries are expected, as it imposes a hard cap on all uploads. Additionally, disabling open registration and restricting attachment permissions to trusted users reduces the attack surface without affecting normal operations.