# CVE-2020-13246: GO-2022-0830 - Denial of Service in Gitea in code.gitea.io/gitea

Source: https://junglewise.ai/threats/cve-2020-13246-denial-of-service-in-gitea  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-21  
License: CC BY 4.0 with a link back

CVE-2020-13246 · Severity: low · CVSS 3.1 · Published 2024-08-21

Denial of Service in Gitea in code.gitea.io/gitea

Technologies: [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea), [github.com/go-gitea/gitea (Go)](https://junglewise.ai/threats/technologies/github-com-go-gitea-gitea). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2020-13246 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-13246 being exploited in the wild.

**How severe is CVE-2020-13246?** Low severity, with a CVSS score of 3.1, published 21 August 2024.

**Which products and versions are affected?** code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.12.0; github.com/go-gitea/gitea (Go) SEMVER:introduced=0,fixed=1.12.0.

**Is there a fix for CVE-2020-13246?** Yes. code.gitea.io/gitea (Go): upgrade to 1.12.0 or later; github.com/go-gitea/gitea (Go): upgrade to 1.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2020-13246?** Check whether you run code.gitea.io/gitea (Go) or github.com/go-gitea/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- code.gitea.io/gitea (Go): upgrade to 1.12.0 or later

  ```sh
  go get code.gitea.io/gitea@v1.12.0
  ```

- github.com/go-gitea/gitea (Go): upgrade to 1.12.0 or later

  ```sh
  go get github.com/go-gitea/gitea@v1.12.0
  ```


## Affected products

- code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.12.0
- github.com/go-gitea/gitea (Go) SEMVER:introduced=0,fixed=1.12.0

## Identifiers

- CVE-2020-13246
- GHSA-g2qx-6ghw-67hm
- GO-2022-0830

## Related threats

- [Gitea incorrect authorization in starred repos and tracked times API](https://junglewise.ai/threats/cve-2026-59766-gitea-incorrect-authorization-in-starred-repos-and-tracked-times)
- [Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.](https://junglewise.ai/threats/cve-2026-60004-gitea-code-injection-in-diffpatch-api)
- [SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata](https://junglewise.ai/threats/cve-2026-59765-gitea-ssrf-and-local-file-read-via-migration-asset-bypass)
- [Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads](https://junglewise.ai/threats/cve-2026-59763-gitea-resource-amplification-in-arch-package-metadata-parsing)
- [Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata](https://junglewise.ai/threats/cve-2026-34966-gitea-ssrf-via-migration-asset-downloads-bypasses-hostmatcher)