# CVE-2026-50879: Andrei Marcu linx-server Denial of Service in uploadPostHandler

Source: https://junglewise.ai/threats/cve-2026-50879-andrei-marcu-linx-server-denial-of-service-in-uploadposthandler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-50879 · Severity: high · CVSS 7.5 · Published 2026-06-15

linx-server is a file upload and sharing application. An attacker can cause a denial of service by sending crafted POST requests that consume temporary disk storage without respecting the configured upload size limit. An attacker can fill the server's temporary storage by sending oversized multipart uploads in parallel, rendering the service unavailable.

Technologies: [Andrei Marcu Linx-Server](https://junglewise.ai/threats/technologies/linx-server). Vendors: [Andrei Marcu](https://junglewise.ai/threats/vendors/andrei-marcu), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-50879 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50879 being exploited in the wild.

**How severe is CVE-2026-50879?** High severity, with a CVSS score of 7.5, published 15 June 2026.

**Which products and versions are affected?** Andrei Marcu Linx-Server <= 2.3.8, 2.3.8; github.com/andreimarcu/linx-server (Go) <= 2.3.8, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=2.3.8.

**Is there a fix for CVE-2026-50879?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-50879 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-50879?** Check whether you run Andrei Marcu Linx-Server or github.com/andreimarcu/linx-server (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an uncontrolled resource consumption flaw (CWE-400) in the uploadPostHandler component. linx-server calls Go's r.FormFile("file") to handle multipart uploads, which automatically spools file content to temporary disk storage during parsing. The application's size limit check (Config.maxSize) is performed after FormFile returns, meaning attackers can force large file content into temporary storage before the size enforcement is applied. The attacker can exploit this by sending POST requests to /upload/ with multipart bodies larger than the configured maximum; the temporary files will be written to disk and only rejected afterward, exhausting temporary storage. No patch has been released as of the advisory date. The attack requires network access to the upload endpoint with no authentication or user interaction needed.

## Affected products

- Andrei Marcu linx-server <= 2.3.8

## Identifiers

- CVE-2026-50879
- GHSA-g743-m6x3-v6wm
- GO-2026-6297

## Timeline

- 2026-06-15: disclosed
- 2026-06-15: advisory: Published to GitHub Advisory Database and NVD

## References

- [https://gist.github.com/pyuysig/807d92e6d8e7648d140d004f3b54b08b](https://gist.github.com/pyuysig/807d92e6d8e7648d140d004f3b54b08b)

## Related threats

- [andreimarcu linx-server SSRF in uploadRemote function](https://junglewise.ai/threats/cve-2026-52101-andreimarcu-linx-server-ssrf-in-uploadremote-function)
- [andreimarcu linx-server CSRF in uploadPutHandler](https://junglewise.ai/threats/cve-2026-52100-andreimarcu-linx-server-csrf-in-uploadputhandler)