https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T11:42:47.743596+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-276013 EUVD-2026-276013 2026-10-06T11:42:47.790803+00:00 EUVD-2026-276013 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30955 fkie_cve-2026-30955 2026-10-06T11:42:47.790847+00:00

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This vulnerability is fixed in 2.2.4.

 https://cve.radiocsirt.org/vuln/ghsa-qwc6-vc2v-2ggj GHSA-qwc6-vc2v-2ggj — Gokapi vulnerable to DoS in E2E Metadata Parser 2026-10-06T11:42:47.790881+00:00

Affected: Go: github.com/forceu/gokapi

### Summary

An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users.

### Impact

Any authenticated user can crash the Gokapi server by sending concurrent large payloads.