En bref
- CVE-2026-30955 est une vulnérabilité MOYENNE (CVSS 6.5) touchant github.com/forceu/gokapi, gokapi (forceu).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.26%, plus élevée que 17.5% des vulnérabilités.
- Correctif : mettre à jour vers 2.2.4 ou plus récent.
Description
Summary
An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users.
Impact
Any authenticated user can crash the Gokapi server by sending concurrent large payloads.
NVD description
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This vulnerability is fixed in 2.2.4.
Autres vulnérabilités de github.com/forceu/gokapi
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free