CVE-2026-50139

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check, and all are served — exceeding the operator's intended cap. Version 2.1.0 patches the issue.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/goshs-labs/goshs/security/advisories/GHSA-j48m-h7xq-2xpj
https://github.com/goshs-labs/goshs/security/advisories/GHSA-j48m-h7xq-2xpj

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) goshs es un SimpleHTTPServer escrito en Go. Antes de la versión 2.1.0, ’ShareHandler’ lee el ’DownloadLimit’ del token de compartición bajo ’RLock’, libera el bloqueo, sirve el archivo y luego vuelve a adquirir el bloqueo para incrementar el contador. Las solicitudes concurrentes leen la misma instantánea de ’Downloaded’/’DownloadLimit’, todas pasan la verificación y todas son servidas - excediendo el límite previsto por el operador. La versión 2.1.0 corrige el problema.

Information

Published : 2026-08-18 15:16

Updated : 2026-10-22 22:10

NVD link : CVE-2026-50139

Mitre link : CVE-2026-50139

CVE.ORG link : CVE-2026-50139

JSON object : View

Products Affected

No product.

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2026-50139", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50139", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T14:33:06.319046Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "patrickhener", "product": "goshs", "versions": [{"status": "affected", "version": "< 2.1.0"}]}]}], "published": "2026-08-18T15:16:54.733", "references": [{"url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-j48m-h7xq-2xpj", "source": "security-advisories@github.com"}, {"url": "https://github.com/goshs-labs/goshs/security/advisories/GHSA-j48m-h7xq-2xpj", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check, and all are served \u2014 exceeding the operator's intended cap. Version 2.1.0 patches the issue."}, {"lang": "es", "value": "goshs es un SimpleHTTPServer escrito en Go. Antes de la versi\u00f3n 2.1.0, \u2019ShareHandler\u2019 lee el \u2019DownloadLimit\u2019 del token de compartici\u00f3n bajo \u2019RLock\u2019, libera el bloqueo, sirve el archivo y luego vuelve a adquirir el bloqueo para incrementar el contador. Las solicitudes concurrentes leen la misma instant\u00e1nea de \u2019Downloaded\u2019/\u2019DownloadLimit\u2019, todas pasan la verificaci\u00f3n y todas son servidas - excediendo el l\u00edmite previsto por el operador. La versi\u00f3n 2.1.0 corrige el problema."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "security-advisories@github.com"}