CVE-2026-50139: patrickhener goshs race condition in share-link download limit

CVE-2026-50139 · Severity: medium · CVSS 5.9 · Published 2026-08-18

goshs, a tool for sharing files over HTTP, contains a flaw in its 'share-link' feature. This feature allows users to create links with a specific download limit (e.g., a one-time use link). Due to a synchronization error, multiple people can download the file simultaneously, bypassing the intended limit and potentially allowing unauthorized access to sensitive data if a link is leaked or intercepted.

Technologies: goshs.de/goshs (Go), goshs.de/goshs/v2 (Go). Vendors: Go.

Quick answers

Is CVE-2026-50139 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50139 being exploited in the wild.
How severe is CVE-2026-50139?
Medium severity, with a CVSS score of 5.9, published 18 August 2026.
Which products and versions are affected?
goshs.de/goshs (Go) SEMVER:introduced=0; goshs.de/goshs/v2 (Go) <= 2.0.9, SEMVER:introduced=0,fixed=2.1.0.
Is there a fix for CVE-2026-50139?
Yes. goshs.de/goshs/v2 (Go): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50139 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50139?
Check whether you run goshs.de/goshs (Go) or goshs.de/goshs/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • goshs.de/goshs/v2 (Go): upgrade to 2.1.0 or later
    go get goshs.de/goshs/v2@v2.1.0

Technical details

A race condition (CWE-362) exists in the `ShareHandler` component of goshs. The application reads the `DownloadLimit` for a token under a read-lock (`RLock`), releases the lock to serve the file, and only re-acquires a write-lock to increment the `Downloaded` counter after the transfer is complete. This creates a timing window where multiple concurrent goroutines can observe the same pre-increment state, allowing N clients to successfully redeem a link intended for fewer uses. An attacker can exploit this via network requests to exfiltrate data beyond the operator's intended cap. The issue is addressed in version 2.1.0 by moving the counter increment and limit check inside a single atomic lock operation before the file is served.

Affected products

  • patrickhener goshs <= 2.0.9

Identifiers

  • CVE-2026-50139
  • GHSA-j48m-h7xq-2xpj
  • GO-2026-5881

Timeline

  • 2026-05-27: disclosed: Vulnerability reproduced by researcher
  • 2026-05-28: advisory: GitHub Advisory published by maintainer
  • 2026-07-01: patched: Version 2.1.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.