6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30955

CVE-2026-30955: Gokapi vulnerable to DoS in E2E Metadata Parser

Summary

An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users.

Impact

Any authenticated user can crash the Gokapi server by sending concurrent large payloads.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30955

CVE-2026-30955:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/forceu/gokapi	go	<= 2.2.3	2.2.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as a Denial of Service in the E2E Metadata Parser (GHSA-qwc6-vc2v-2ggj), is caused by an API endpoint accepting unbounded request bodies. Analysis of the patches between vulnerable version v2.2.3 and patched version v2.2.4 reveals several changes to address this issue.

The primary vulnerable function is paramE2eStore.ProcessParameter in internal/webserver/api/routing.go. The vulnerability title directly points to the "E2E Metadata Parser". Before the patch, this function read the entire request body into memory to decode JSON, without any size limitation. The patch, in commit dc9347294e18a5ae12bf629dd189c6283aef7568, introduces http.MaxBytesReader to limit the request body to 5MB, directly mitigating the OOM vulnerability.

As a defense-in-depth measure, the patches also harden the file upload functionality. The ProcessNewChunk function in internal/webserver/fileupload/FileUpload.go and the allocateFile function in internal/storage/chunking/Chunking.go were modified in commits e55edf49e1755f17ec59d9328e87abdbb131d017 and f45e869d2a9de22f64cce45b8fe04de7bcc83e89 to enforce file size limits earlier in the upload process. These changes prevent attackers from causing resource exhaustion through the file upload mechanism by declaring excessively large files.

Therefore, during exploitation, a profiler would likely show paramE2eStore.ProcessParameter being called when the E2E metadata endpoint is targeted. If the file upload vector is used, ProcessNewChunk and allocateFile would appear in the runtime profile.

Vulnerable functions

paramE2eStore.ProcessParameter

internal/webserver/api/routing.go

This function processes the E2E metadata store request. Before the patch, it decoded the JSON request body without any size limit. An authenticated attacker could send a very large request body, causing the server to consume excessive memory, leading to a denial of service (OOM kill). The patch introduces a 5MB limit on the request body size.

ProcessNewChunk

internal/webserver/fileupload/FileUpload.go

This function processes file chunks during an upload. The original implementation did not validate the `TotalFilesizeBytes` from the request against a maximum allowed size. This allowed an attacker to initiate an upload with a very large declared file size, potentially leading to excessive resource allocation and denial of service. The patch adds a check against the `maxFileSize` passed from the calling handler.

allocateFile

internal/storage/chunking/Chunking.go

This function is responsible for allocating disk space for a new file upload. The vulnerability lies in the lack of validation of the `TotalFilesizeBytes` field in the `ChunkInfo` struct against the system's configured maximum file size. An attacker could provide a large value for `TotalFilesizeBytes`, causing the application to attempt to allocate a large file, leading to resource exhaustion. The patch ensures the declared size is within the allowed limits.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.