{"id":"CVE-2026-50139","title":"goshs is a SimpleHTTPServer written in Go","summary":"goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent r…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-362"],"vendor":"goshs","product":"goshs.de/goshs/v2","affected":["goshs.de/goshs/v2 <= 2.0.9"],"patched":["goshs.de/goshs/v2 2.1.0"],"published":"2026-08-18","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50139","references":[{"url":"https://github.com/goshs-labs/goshs/security/advisories/GHSA-j48m-h7xq-2xpj","label":"security-advisories@github.com"},{"url":"https://github.com/goshs-labs/goshs/security/advisories/GHSA-j48m-h7xq-2xpj","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/patrickhener/goshs/security/advisories/GHSA-j48m-h7xq-2xpj"},{"url":"https://github.com/advisories/GHSA-j48m-h7xq-2xpj"}],"tags":["nvd","ghsa","go"],"epss":0.00275,"epssPercentile":0.20138,"ecosystem":"go","ingestedAt":"2026-07-01T22:17:35.208Z","slug":"CVE-2026-50139","body":"## Overview\n\ngoshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check, and all are served — exceeding the operator's intended cap. Version 2.1.0 patches the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-50139)\n\nAffected packages:\n\n- `goshs.de/goshs/v2 <= 2.0.9`\n\nPatched in:\n\n- `goshs.de/goshs/v2 2.1.0`\n\nSource: https://github.com/advisories/GHSA-j48m-h7xq-2xpj","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}