---
id: CVE-2026-39904
aliases:
  - GHSA-42jc-v69j-g38f
title: Gophish contains a denial of service vulnerability
summary: Gophish contains a denial of service vulnerability
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
vendor: gophish
product: github.com/gophish/gophish
ecosystem: go
affected:
  - github.com/gophish/gophish <= 0.12.1
published: '2026-06-22'
updated: '2026-08-06'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-42jc-v69j-g38f'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-39904'
  - url: >-
      https://github.com/ashikmd7/GoPhish-0.12.1/blob/main/Unbounded%20Memory%20Allocation%20in%20Office%20Attachment%20Processing%20Leads%20to%20Server%20DoS/README.md
  - url: 'https://github.com/gophish/gophish'
  - url: >-
      https://www.vulncheck.com/advisories/gophish-denial-of-service-via-office-document-upload
tags:
  - osv
  - go
epss: 0.00436
epssPercentile: 0.35228
ingestedAt: '2026-08-07T19:14:15.621Z'
---

## Overview

Gophish through 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system.

## Affected packages

- `github.com/gophish/gophish <= 0.12.1`

## Remediation

Refer to the advisory for the patched release.