CVE-2026-50139
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In goshs, a SimpleHTTPServer written in Go, before version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same snapshot and pass the check, exceeding the intended cap. Version 2.1.0 patches the issue.
Risk Assessment
Operators may have download limits exceeded, potentially leading to uncontrolled resource usage or violation of file access policies.
Recommendation
Upgrade goshs to version 2.1.0 or later, which includes the fix.
Original NVD description (English source)
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check, and all are served — exceeding the operator's intended cap. Version 2.1.0 patches the issue.