On 2025-12-22, a security vulnerability CVE 2025-68971 (CVSS: 5.5/MEDIUM) was discovered in open-source Forgejo 13.0.3 application first detected on FreeBSD14 operating system. It caused the operating system went into mass-killing all system applications and services due to memory starvation as Forgejo hogged the entire operating system's available free memories for temporarily storing attachment file upload fragments. Whenever an attachment file of size greater than the operating system's entire memory can handle is uploaded by any user, the operating system has no choice but to kill all services and applications and restart its runtime. The killing includes but not limited to runtime graphical user interface and network services such as XOrg, LXQt desktop manager, Nginx reverse proxy server, and SSH server. The fallout effect is data loss and data corruption due to unexpected program termination. On 2026-01-16, Forgejo security team patched the security vulnerability mediation in version 14.0.0 and by 2026-03-11, version 14.0.0, 14.0.1, and 14.0.2 were all tested and verified the security vulnerability was fixed. The conclusion is that the public MUST upgrade Forgejo to version 14.0.2 and above for mitigating this vulnerability. That is all. Otherwise, this report detailed the vulnerability and its mediation data solely for archiving and educational purposes only.

Changelog v2.0.0 Removed contributors as requested. v1.0.0 (You are here - Please USE the updated v2.0.0) Compiled and published.