{"id":"EUVD-2026-60950","enisaUuid":"0c91ec61-c11f-3606-a6a6-9abd50d9623a","description":"goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token\u0027s `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check, and all are served — exceeding the operator\u0027s intended cap. Version 2.1.0 patches the issue.","datePublished":"Aug 18, 2026, 3:01:36 PM","dateUpdated":"Aug 19, 2026, 2:34:47 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/goshs-labs/goshs/security/advisories/GHSA-j48m-h7xq-2xpj\n","aliases":"CVE-2026-50139\nGHSA-j48m-h7xq-2xpj\n","assigner":"GitHub_M","epss":0.26,"enisaIdProduct":[{"id":"ba3188fc-0cc0-3abe-b040-b5676808a3b5","product":{"name":"goshs","vendor":{"name":"patrickhener"}},"product_version":"\u003c 2.1.0"}],"enisaIdVendor":[{"id":"0fb8d169-0fc9-3a87-9be8-4acd314a4213","vendor":{"name":"patrickhener"}}],"enisaIdVulnerability":[{"id":"007c468a-9857-3b53-aa34-a36e713530e1","vulnerability":{"id":"CVE-2026-50139","description":"goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token\u0027s `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check, and all are served — exceeding the operator\u0027s intended cap. Version 2.1.0 patches the issue.","datePublished":"Aug 18, 2026, 3:01:36 PM","dateUpdated":"Aug 19, 2026, 2:34:47 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/goshs-labs/goshs/security/advisories/GHSA-j48m-h7xq-2xpj\n","enisa_id":"EUVD-2026-60950\n","assigner":"GitHub_M","epss":0.26,"dataProcessed":"Nov 1, 2026, 7:16:18 AM","vulnerabilityProduct":[{"id":"58362579-a434-3d03-8ac7-89b68f8435b1","product":{"name":"goshs","vendor":{"name":"patrickhener"}},"product_version":"\u003c 2.1.0"}],"vulnerabilityVendor":[{"id":"6b502105-1bf2-3d6e-af14-8e01a6342403","vendor":{"name":"patrickhener"}}]}},{"id":"8c48fb3d-c94f-3eeb-b615-8beb313ca032","vulnerability":{"id":"GHSA-j48m-h7xq-2xpj","description":"goshs: Share-link ?token\u003d… redemption races past download limit","datePublished":"Jul 1, 2026, 9:59:08 PM","dateUpdated":"Jul 1, 2026, 9:59:08 PM","baseScore":0.0,"references":"https://github.com/patrickhener/goshs/security/advisories/GHSA-j48m-h7xq-2xpj\nhttps://github.com/patrickhener/goshs\n","enisa_id":"EUVD-2026-60950\n","aliases":"CVE-2026-50139\nGHSA-j48m-h7xq-2xpj\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}