CVE 2025-68971 | (Holloway) Chew, Kean Ho's Knowledge Research

On 2025-12-22, a security vulnerability CVE 2025-68971 (CVSS: 5.5/MEDIUM) was discovered in open-source Forgejo 13.0.3 application first detected on FreeBSD14 operating system. It caused the operating system went into mass-killing all system applications and services due to memory starvation as Forgejo hogged the entire operating system's available free memories for temporarily storing attachment file upload fragments. Whenever an attachment file of size greater than the operating system's entire memory can handle is uploaded by any user, the operating system has no choice but to kill all services and applications and restart its runtime. The killing includes but not limited to runtime graphical user interface and network services such as XOrg, LXQt desktop manager, Nginx reverse proxy server, and SSH server. The fallout effect is data loss and data corruption due to unexpected program termination.

On 2026-01-16, Forgejo security team patched the security vulnerability mediation in version 14.0.0 and by 2026-03-11, version 14.0.0, 14.0.1, and 14.0.2 were all tested and verified the security vulnerability was fixed. The conclusion is that the public MUST upgrade Forgejo to version 14.0.2 and above for mitigating this vulnerability.

That is all. Otherwise, this report detailed the vulnerability and its mediation data solely for archiving and educational purposes only.

---

Please refer to Releases section for the latest version of the report.

Verifying Content Integrity

To secure the content from unauthorized modification by anyone down to bit-level (0|1), they are cryptographically signed using one or more cryptography tools such as but not limited to:

• GnuPG; AND/OR
• OpenSSL.

The public key and the associated certificate are attached. Only the main owner keeps and maintains the private keys. To verify the content's integrity:

GnuPG

1. Install GnuPG software if not present.
2. Download the target file and its detached signature file (the .asc file with the same filename).
3. Download the public key file (.gpg).
4. Place them next to each other in the directory.
5. Open a terminal and execute the following command:

$ gpg --no-default-keyring --keyring /path/to/public.gpg --verify /path/to/file.asc

OpenSSL

1. Install OpenSSL software if not present.
2. Download the target file and its detached signature file (the .sig/.sign file with the same filename).
3. Download the public certificate file (.pem) containing the public key within.
4. Place them next to each other in the directory.
5. Open a terminal and execute the following command:

$ openssl dgst -verify /path/to/pubkey.pem -signature /path/to/file.sig /path/to/file

Artificial Intelligence (A.I.) Decrees

This decree defines the project’s policy on the use of Artificial Intelligence. The following sections list data lifecycle activities and indicate whether A.I. is deployed. Unless explicitly stated otherwise (e.g. deployment with specifics), A.I. is not used for these tasks.

Data Sourcing & Acquisition

[!Note]

Example activities:

• Performing enhanced web searches due to search engine pollution by A.I. slop contents.
• Performing completely auto-generated media such as but not limited to images, videos, and audios.

• Multiple Large Language Model (LLM) A.I.s as the search engine for searching research materials across the Internet due to massive unwanted A.I publication slops.
• One or more LLM A.I.s as the grammar and language corrector and enhancer for superpervised improvement against human written content.

Data Processing & Transformation

[!Note]

Example activities:

• Performing multi-steps process development.
• Performing data sanitization like data cleaning and data deduplication.
• Performing data format compatibility conversion.
• Constructing and optimizing data processing libraries.
• Upscaling an image with neural network not achievable with conventional image manipulation technologies.

• No deployment.

Data Storage & Security

[!Note]

Example activities:

• Performing security and threat detection.
• Performing Data at Rest encryption and health monitoring.
• Performing encryption data storage management.
• Performing automated data storage house-keeping.
• Performing data storage devices health monitoring and mitigation.

• No deployment.

Data Analysis & Insight Generation

[!Note]

Example activities:

• Performing multi-steps data analytics.
• Performing pattern detection and recognition.
• Developing predictive modelling.
• Developing natural language queries models.
• Creating artificial intelligence's neural network models based on data feeds.
• Optimizing artificial intelligence's transfer learning, hyperparameter tuning, etc.

• No deployment.

Data Quality Validation & Assurances

[!Note]

Example activities:

• Performing end-user use case simulated testings.
• Performing automated sanity testings.
• Performing penetration & security testings.
• Performing anomaly detection testings.
• Performing schema validations.
• Performing automated testing of data pipelines.

• No deployment.

Data Visualization & Reporting

[!Note]

Example activities:

• Performing data graphical visualization creation based on data feeds.
• Performing summarized dashboarding with graphical design and data feeds.
• Performing report writing.
• Performing prediction projections.

• No deployment.

Data Governance & Compliance

[!Note]

Example activities:

• Performing personal identifiable information (PII) filtration and removal.
• Performing regulatory compliance checks (e.g., data filtration, censorship, removal as required by law).
• Performing compliance monitoring and validation.
• Performing data lineage tracking and analysis.
• Performing data audit trail analysis.

• No deployment.

Data Sharing & Publication

[!Note]

Example activities:

• Performing document's metadata creation.
• Performing document translation.
• Processing data publication licensing and management.

• No deployment.

Maintainers' Notes