CVE-2026-50139: goshs Race Condition Vulnerability

CVE-2026-50139 Overview

CVE-2026-50139 is a race condition [CWE-362] in goshs, a SimpleHTTPServer written in Go. The ShareHandler function reads a share token's DownloadLimit under a read lock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests read the same Downloaded and DownloadLimit snapshot, all pass the check, and all receive the file. This lets attackers exceed the operator's intended download cap. Version 2.1.0 of goshs patches the flaw.

Critical Impact
Concurrent requests bypass the enforced DownloadLimit on share tokens, allowing unauthorized file distribution beyond the operator-configured maximum.

Affected Products

goshs SimpleHTTPServer versions prior to 2.1.0
Fixed in goshs 2.1.0

Discovery Timeline

2026-08-18 - CVE-2026-50139 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-50139

Vulnerability Analysis

The flaw is a time-of-check to time-of-use (TOCTOU) race condition in the ShareHandler code path. The handler follows a check-serve-update sequence with a non-atomic gap between the check and the update. During this window, any number of concurrent HTTP requests can each observe the same Downloaded counter value and each conclude that another download is permitted.

Because the counter is incremented only after the file has been served, all racing requests successfully complete before the counter reflects any of them. This defeats the purpose of the DownloadLimit control, which operators use to restrict distribution of shared files. The attack requires no authentication and can be launched over the network using ordinary HTTP clients.

Root Cause

The root cause is improper synchronization around a critical section. The RLock protects only the read of the limit and counter, not the entire check-serve-increment operation. A correct implementation must perform the limit check and counter increment atomically, for example under a single write lock or using an atomic compare-and-swap, before the file is served.

Attack Vector

An attacker who knows or guesses a valid share token can issue multiple parallel HTTP GET requests to the share endpoint. Each request enters the ShareHandler before any prior request increments the counter. All requests pass the Downloaded < DownloadLimit check and receive the shared file. Exploitation requires only a standard HTTP client capable of concurrent requests. The vulnerability affects confidentiality of shared files but does not impact integrity or availability of the server itself.

See the GitHub Security Advisory GHSA-j48m-h7xq-2xpj for the maintainer's technical description.

Detection Methods for CVE-2026-50139

Indicators of Compromise

Multiple near-simultaneous HTTP GET requests to the same /s/ share token endpoint from one or more source addresses.
Access logs showing more successful 200 OK responses for a share token than the configured DownloadLimit value.
Bursts of parallel TCP connections to the goshs listener with identical request paths.

Detection Strategies

Parse goshs access logs and count successful responses per share token. Alert when the count exceeds the token's configured DownloadLimit.
Baseline typical request concurrency for share endpoints and flag anomalous parallel request bursts.
Correlate source IP diversity against a single share token to detect distributed abuse.

Monitoring Recommendations

Forward goshs HTTP access logs to a centralized log store and retain them long enough to reconstruct share sessions.
Track request rate per share token and generate alerts when the rate approaches or exceeds the limit within short time windows.
Monitor process and network telemetry on hosts running goshs, since operators often deploy it on temporary or ad-hoc file transfer systems.

How to Mitigate CVE-2026-50139

Immediate Actions Required

Upgrade goshs to version 2.1.0 or later on all systems where the binary is deployed.
Revoke any share tokens created on vulnerable versions and reissue them after upgrading.
Audit access logs for share tokens that received more downloads than their configured limit.

Patch Information

goshs version 2.1.0 fixes the race condition by making the download-limit check and counter update atomic. Users should upgrade using their normal Go binary or package installation workflow. Release details are available in the GitHub Security Advisory GHSA-j48m-h7xq-2xpj.

Workarounds

Do not rely on DownloadLimit for security-critical distribution controls on vulnerable versions.
Restrict access to the goshs listener behind an authenticated reverse proxy or firewall rules that limit source addresses.
Use short-lived shares and manually stop the server once the intended recipient has retrieved the file.

bash

# Upgrade goshs to the patched release
go install github.com/patrickhener/goshs@v2.1.0

# Verify the installed version
goshs -v