CVE-2026-30955CWE-400

Gokapi vulnerable to DoS in E2E Metadata Parser

Medium · published March 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This vulnerability is fixed in 2.2.4.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-03-13T19:07Z
EPSS history
Timeline
  • 13 MAR 19:07Z
    Gokapi vulnerable to DoS in E2E Metadata Parser
    cvelistv5