Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This vulnerability is fixed in 2.2.4.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
GitHub Advisories released a security advisory .
A CVSS base score of 6.5 has been assigned.
Feedly found the first article mentioning CVE-2026-30955 . See article
NVD published the first details for CVE-2026-30955
[GHSA-qwc6-vc2v-2ggj] Gokapi vulnerable to DoS in E2E Metadata Parser
CVE-2026-30955 | Forceu Gokapi up to 2.2.3 API Endpoint resource consumption
CVE-2026-30955: CWE-400: Uncontrolled Resource Consumption in Forceu Gokapi
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
