forceu/gokapi · Security
Gokapi vulnerable to DoS in E2E Metadata Parser
- GHSA ID
- GHSA-qwc6-vc2v-2ggj
- CVE ID
- CVE-2026-30955
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 6.5 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Description
Summary
An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users.
Impact
Any authenticated user can crash the Gokapi server by sending concurrent large payloads.
CWEs
- CWE-400 · Uncontrolled Resource Consumption