medium6.5
CVE-2026-30955
Gokapi vulnerable to DoS in E2E Metadata Parser
Impact
### Summary An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. ### Impact Any authenticated user can crash the Gokapi server by sending concurrent large payloads.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/forceu/gokapi | <= 2.2.3 | 2.2.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Forceu | Gokapi | before 2.2.4 |