CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2026-30955
Medium (6.5) in forceu gokapi. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/forceu/gokapi 2.2.4.
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This vulnerability is fixed in 2.2.4.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- forceu:gokapi
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qwc6-vc2v-2ggj | Go | github.com/forceu/gokapi | <2.2.4 | 2.2.4 |
| GO-2026-4698 | Go | github.com/forceu/gokapi | all versions | no fix published |