--- title: Forgejo Security Release 1.18.5-0 | daily.dev description: Forgejo v1.18.5-0 has been released with an important security fix that raises password hashing protection against brute force attacks to meet industry... canonical: https://daily.dev/posts/forgejo-security-release-1-18-5-0-oyz0xutln twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Forgejo Security Release 1.18.5-0 | daily.dev og:description: Forgejo v1.18.5-0 has been released with an important security fix that raises password hashing protection against brute force attacks to meet industry... og:url: https://daily.dev/posts/forgejo-security-release-1-18-5-0-oyz0xutln og:image: https://api.daily.dev/og/posts/oYz0XUtln.png og:image:alt: Forgejo Security Release 1.18.5-0 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Forgejo Security Release 1.18.5-0 **[Forgejo News](https://daily.dev/sources/forgejo)** · 4 min read · 0 upvotes · 0 comments ## Summary Forgejo v1.18.5-0 has been released with an important security fix that raises password hashing protection against brute force attacks to meet industry standards. The default PBKDF2-HMAC-SHA256 work factor is increased to 320,000 iterations (32x more CPU-intensive than before), aligning with OWASP December 2022 recommendations. Existing password hashes are automatically upgraded on next login. Admins experiencing high CPU load can revert to the old algorithm temporarily, but the recommended long-term solution is switching git and API authentication to SSH keys and access tokens. The Forgejo security team also disclosed this weakness to the Gitea security team on the same day. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- [View this post on daily.dev](https://daily.dev/posts/forgejo-security-release-1-18-5-0-oyz0xutln) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Forgejo Security Release 1.18.5-0","url":"https://daily.dev/posts/forgejo-security-release-1-18-5-0-oyz0xutln","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/forgejo-security-release-1-18-5-0-oyz0xutln"},"datePublished":"2026-07-26T07:49:06.407Z","dateModified":"2026-07-26T07:52:58.738Z","description":"Forgejo v1.18.5-0 has been released with an important security fix that raises password hashing protection against brute force attacks to meet industry...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ecd9058ec824271361a436684af5bb15?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ecd9058ec824271361a436684af5bb15?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Forgejo News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Forgejo News","logo":"https://media.daily.dev/image/upload/s--Cq9uBvkb--/f_auto,q_auto/v1785052096/logos/forgejo?_a=BAMAMicg0","url":"https://daily.dev/sources/forgejo"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/forgejo-security-release-1-18-5-0-oyz0xutln","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Forgejo News","item":"https://daily.dev/sources/forgejo"},{"@type":"ListItem","position":3,"name":"Forgejo Security Release 1.18.5-0"}]} ```