Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Gokapi servers can be crashed by large data requests

CVE-2026-30955 · published 7 months ago
Summary

Gokapi servers are at risk of being shut down by users sending large amounts of data, disrupting service for everyone. This can be done by any user with a valid login. To prevent this, Gokapi servers should be updated to limit the size of data requests.

What to do
  • Update github.com forceu to version 2.2.4.
  • Update forceu github.com/forceu/gokapi to version 2.2.4.
  • Update forceu gokapi to version 2.2.4 or later.
Affected software
Ecosystem VendorProductAffected versions
go github.com forceu <= 2.2.3
Fix: upgrade to 2.2.4
Go forceu github.com/forceu/gokapi < 2.2.4
Fix: upgrade to 2.2.4
– forceu gokapi < 2.2.4
cpe:2.3:a:forceu:gokapi:*:*:*:*:*:*:*:*
Original advisory text
Gokapi vulnerable to DoS in E2E Metadata Parser
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This vulnerability is fixed in 2.2.4.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published13 Mar 2026
Updated4 Nov 2026
First seen13 Mar 2026
Sources
GHSA-qwc6-vc2v-2ggj · GHSA
CVE-2026-30955 · NVD
GHSA-qwc6-vc2v-2ggj · OSV
CVE-2026-30955 · OSV
Track software like this
Free during beta