Gokapi vulnerable to DoS in E2E Metadata Parser

MEDIO 6.5CVE-2026-30955 · GHSA-qwc6-vc2v-2ggj · GO-2026-4698 · Published 13/03/2026 · updated 17/06/2026

In breve

CVE-2026-30955 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda github.com/forceu/gokapi, gokapi (forceu).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.26%, superiore al 17.5% delle vulnerabilità.
Correzione: aggiornare a 2.2.4 o successiva.

Package	Affected versions	Patched versions
github.com/forceu/gokapi Go	`< 2.2.4all versions`	`2.2.4`
gokapi forceu	`< 2.2.4`	`2.2.4`

Description

Summary

An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users.

Impact

Any authenticated user can crash the Gokapi server by sending concurrent large payloads.

NVD description

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This vulnerability is fixed in 2.2.4.

References

Forceu/Gokapi security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-30955 · ADVISORY
Forceu/Gokapi · PACKAGE
Forceu/Gokapi release v2.2.4 · WEB
pkg.go.dev/vuln/GO-2026-4698 · WEB

Altre vulnerabilità di github.com/forceu/gokapi

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/forceu/gokapi

< 2.2.4all versions

2.2.4

gokapi

forceu

< 2.2.4

2.2.4

Description

Summary

An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users.

Impact

Any authenticated user can crash the Gokapi server by sending concurrent large payloads.

NVD description

Altre vulnerabilità di github.com/forceu/gokapi

Vedi tutto →