What is CVE-2026-30955?

CVE-2026-30955 is a medium-severity vulnerability in Forceu Gokapi, classified under Uncontrolled Resource Consumption. CVSS score: 6.5/10. Published 2026-03-13.

How severe is CVE-2026-30955?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Resource exhaustion in Forceu Gokapi

CVE-2026-30955

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This vulnerability is fixed in 2.2.4.

Vulnerability class: DoS (Denial of Service)

EPSS: 0.002 (16.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Forceu Gokapi — versions < 2.2.4

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Product, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2026-30955?: CVE-2026-30955 is a medium-severity vulnerability in Forceu Gokapi, classified under Uncontrolled Resource Consumption. CVSS score: 6.5/10. Published 2026-03-13.
How severe is CVE-2026-30955?: Medium severity. CVSS v3 base score is 6.5 out of 10.