What is GHSA-qwc6-vc2v-2ggj?

GHSA-qwc6-vc2v-2ggj is a security advisory published by GitHub Security Advisories with Medium severity. Gokapi vulnerable to DoS in E2E Metadata Parser

Which CVE IDs does GHSA-qwc6-vc2v-2ggj cover?

GHSA-qwc6-vc2v-2ggj covers the following CVE IDs: CVE-2026-30955. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qwc6-vc2v-2ggj?

GHSA-qwc6-vc2v-2ggj has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-qwc6-vc2v-2ggj?

GHSA-qwc6-vc2v-2ggj affects 1 product, including: go/github.com/forceu/gokapi:\u003c= 2.2.3.

GHSA-qwc6-vc2v-2ggjMediumCVSS 6.5

Gokapi vulnerable to DoS in E2E Metadata Parser

Vendor

GitHub Security Advisories

Published

March 13, 2026

Last Modified

March 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-30955 →

📋 Description

Summary

An API endpoint accepts unbounded request bodies without any size limit. An authenticated user can cause an OOM kill and complete service disruption for all users.

Impact

Any authenticated user can crash the Gokapi server by sending concurrent large payloads.

🎯 Affected products1

go/github.com/forceu/gokapi:<= 2.2.3

🔗 References (5)

https://github.com/Forceu/Gokapi/security/advisories/GHSA-qwc6-vc2v-2ggj
https://github.com/Forceu/Gokapi/releases/tag/v2.2.4
https://nvd.nist.gov/vuln/detail/CVE-2026-30955
https://pkg.go.dev/vuln/GO-2026-4698
https://github.com/advisories/GHSA-qwc6-vc2v-2ggj