What’s Vulnerable › Vulnerabilities

CVE-2026-50139: goshs: Share-link ?token=… redemption races past download limit

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-18 · updated 2026-10-22
• Weakness: CWE-362

Description

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check, and all are served — exceeding the operator's intended cap. Version 2.1.0 patches the issue.

Affected products

• patrickhener goshs: before 2.1.0

References

• https://github.com/goshs-labs/goshs/security/advisories/GHSA-j48m-h7xq-2xpj
• https://github.com/goshs-labs/goshs/security/advisories/GHSA-j48m-h7xq-2xpj

Get alerted when CVE-2026-50139 or the next vulnerability affects your stack