GitHub Advisoryadvisory · Go

GHSA-qwc6-vc2v-2ggj Gokapi vulnerable to DoS in E2E Metadata Parser

MEDIUM Published 2026-03-13 Modified 2026-03-24 Official page ↗
Aliases
CVE-2026-30955
Ecosystem
Go
Packages
github.com/forceu/gokapi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2026-03-13

Affected packages

• Go github.com/forceu/gokapi: < 2.2.4 → fixed in 2.2.4

Description

Summary An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. Impact Any authenticated user can crash the Gokapi server by sending concurrent large payloads.

Related

Alias · CVE (1)

  • CVE-2026-30955 Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References