CVE-2026-30955 MEDIUM

CVE-2026-30955: Gokapi vulnerable to DoS in E2E Metadata Parser

Vendor Forceu
Product Gokapi
Weakness CWE-400
Published March 13, 2026
Last update March 13, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This vulnerability is fixed in 2.2.4.

Key dates

02Disclosure timeline

March 13, 2026 CVE published
March 13, 2026 Record updated