CVE-2026-30955: Forceu Gokapi DOS Vulnerability

CVE-2026-30955 Overview

CVE-2026-30955 is a Resource Exhaustion vulnerability affecting Gokapi, a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.4, an API endpoint accepts unbounded request bodies without any size limit. An authenticated user can exploit this flaw to cause an Out-of-Memory (OOM) kill condition, resulting in complete service disruption for all users.

Critical Impact

Authenticated attackers can trigger complete service denial by exhausting server memory through unbounded API requests, affecting all users of the Gokapi instance.

Affected Products

• Forceu Gokapi versions prior to 2.2.4

Discovery Timeline

• 2026-03-13 - CVE CVE-2026-30955 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-30955

Vulnerability Analysis

This vulnerability falls under CWE-400 (Uncontrolled Resource Consumption). The core issue lies in an API endpoint that fails to implement proper request body size validation. When processing incoming requests, the server does not enforce any upper limit on the size of the request payload, allowing attackers to submit arbitrarily large request bodies.

The attack can be initiated over the network without user interaction. Authentication is required, but only at a low privilege level. The vulnerability exclusively impacts availability, with no confidentiality or integrity concerns. A successful exploit results in the server process consuming excessive memory until the operating system's OOM killer terminates the process, causing complete service disruption.

Root Cause

The root cause is the absence of request body size validation on an API endpoint. When handling HTTP requests, the server reads the entire request body into memory without checking or limiting its size. This lack of input validation creates a condition where memory consumption is controlled by the attacker rather than the application.

In typical secure implementations, web applications should define maximum allowed request body sizes and reject requests exceeding those limits early in the request processing pipeline. Gokapi versions prior to 2.2.4 lacked this protection mechanism.

Attack Vector

The attack is network-based and requires only low-privilege authentication. An attacker with valid credentials to a Gokapi instance can craft malicious HTTP requests with extremely large request bodies targeting the vulnerable API endpoint.

The exploitation flow involves:

1. Authenticating to the Gokapi instance with valid user credentials
2. Sending one or more HTTP requests with excessively large payloads to the vulnerable endpoint
3. The server attempts to read and process the entire request body into memory
4. Memory consumption grows until the system's OOM killer terminates the Gokapi process
5. All users lose access to the file sharing service until the service is restarted

The vulnerability is straightforward to exploit and requires no special tools beyond the ability to craft HTTP requests with large payloads.

Detection Methods for CVE-2026-30955

Indicators of Compromise

• Unusual memory consumption spikes on the server hosting Gokapi
• OOM killer events in system logs referencing the Gokapi process
• Large inbound HTTP requests in web server or reverse proxy access logs
• Service crashes or unexpected restarts of the Gokapi application
• User reports of intermittent or complete service unavailability

Detection Strategies

• Monitor system logs for OOM killer events targeting the Gokapi process
• Implement request body size logging at the reverse proxy or load balancer level to identify anomalously large requests
• Configure memory usage alerting for the Gokapi application process
• Review authentication logs for suspicious patterns of authenticated requests preceding service disruptions

Monitoring Recommendations

• Set up real-time memory usage monitoring with threshold-based alerts for the Gokapi service
• Configure log aggregation to correlate large request events with memory consumption anomalies
• Implement network traffic analysis to detect unusually large HTTP POST or PUT requests
• Enable process monitoring to track unexpected Gokapi service restarts

How to Mitigate CVE-2026-30955

Immediate Actions Required

• Upgrade Gokapi to version 2.2.4 or later immediately
• Review authentication logs for any suspicious activity that may indicate prior exploitation attempts
• Implement request body size limits at the reverse proxy level as an additional layer of defense
• Consider temporarily restricting API access if immediate patching is not possible

Patch Information

The vulnerability has been addressed in Gokapi version 2.2.4. The fix implements proper request body size validation to prevent unbounded memory consumption. Users should upgrade to this version or later to remediate the vulnerability.

For detailed patch information, refer to the Gokapi v2.2.4 Release and the GitHub Security Advisory GHSA-qwc6-vc2v-2ggj.

Workarounds

• Configure request body size limits at the reverse proxy or load balancer level (e.g., client_max_body_size in Nginx)
• Implement rate limiting for authenticated API requests to slow down potential exploitation attempts
• Deploy memory limits using containerization or cgroups to prevent system-wide impact from OOM conditions
• Monitor and alert on unusual memory consumption patterns to enable rapid incident response

# Example Nginx configuration to limit request body size
# Add this to your Nginx server block for Gokapi
location / {
    client_max_body_size 100M;
    proxy_pass http://localhost:53842;
}