CVE-2026-50139
Received Received - Intake

Race Condition in goshs File Download Limit

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check, and all are served — exceeding the operator's intended cap. Version 2.1.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-50139
EUVD
EUVD-2026-60950

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
goshs goshs to 2.1.0 (exc)
goshs goshs 2.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-50139 is a race condition vulnerability in goshs, a Go-based SimpleHTTPServer. It allows concurrent users to bypass download limits on shared links. The issue occurs because the application checks the download limit under a read lock, serves the file after releasing the lock, then increments the counter. This enables multiple requests to pass the initial check before the counter updates, allowing unlimited downloads beyond the intended cap.

Detection Guidance

To detect this vulnerability, check if you are running goshs versions <=2.0.9. Use commands like 'goshs version' or inspect the binary metadata. Monitor for unusual download activity on shared links, especially concurrent requests bypassing set limits.

Impact Analysis

An attacker could exploit this by sending multiple simultaneous requests to a shared link with a download limit of one. All requests would succeed, allowing unauthorized or excessive file downloads. This could lead to bandwidth exhaustion, data exfiltration, or denial-of-service if the server's resources are overwhelmed by repeated download attempts.

Mitigation Strategies

Upgrade goshs to version 2.1.0 or later immediately. If upgrading is not possible, disable the share-link feature or enforce strict rate limiting on shared links to prevent concurrent bypasses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50139. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart