Gokapi is a self-hosted file sharing server with automatic expiration and encryption support.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 13, 2026 · NIST NVD

   Detected

   Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This vulnerability is fixed in 2.2.4.

2. Jun 17, 2026 · NIST NVD

   Updated

   Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This vulnerability is fixed in 2.2.4.

Affected

• cpe forceu/gokapiversion unspecified

Sources

• NIST NVDVulnerability recordCVE-2026-30955

  Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to 2.2.4, An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users. This v

  nvd.nist.gov

References

• Product · github.com
• Vendor Advisory · github.com