{"id":"CVE-2025-68971","aliases":["EUVD-2025-208771","GHSA-8mff-gcgj-hhfr"],"status":"published","title":"In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a...","description":"In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be associated with an issue or a release).","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00531,"percentile":0.4532,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-400"],"published":"2026-03-16T00:00:00Z","modified":"2026-06-17T09:59:55Z","exploits":[{"source":"pocgithub","id":"ChewKeanHo/research-cve-2025-68971","title":"ChewKeanHo/research-cve-2025-68971","date":"2026-03-10","url":"https://github.com/ChewKeanHo/research-cve-2025-68971"}],"references":[{"url":"https://codeberg.org/forgejo/forgejo"},{"url":"https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291973"},{"url":"https://zenodo.org/records/18945481"},{"url":"https://zenodo.org/records/19058493"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68971"},{"url":"https://github.com/advisories/GHSA-8mff-gcgj-hhfr"}],"sources":{"cve":[{"id":"CVE-2025-68971","description":"In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be associated with an issue or a release).","status":"published","published":"2026-03-16T00:00:00Z","modified":"2026-03-17T20:47:45.452Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:35.742256Z"}],"euvd":[{"id":"EUVD-2025-208771","description":"In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be associated with an issue or a release).","status":"published","published":"2026-03-16T00:00:00Z","modified":"2026-03-17T20:47:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:25:33.306068Z"}],"ghsa":[{"id":"GHSA-8mff-gcgj-hhfr","title":"In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a...","description":"In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be associated with an issue or a release).","status":"published","published":"2026-03-16T21:34:32Z","modified":"2026-03-17T18:31:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:06:40.510126Z"}],"nvd":[{"id":"CVE-2025-68971","description":"In Forgejo through 13.0.3, the attachment component allows a denial of service by uploading a multi-gigabyte file attachment (e.g., to be associated with an issue or a release).","status":"published","published":"2026-03-16T20:16:14.863Z","modified":"2026-06-17T09:59:55.227Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:01.641503Z"}]}}