An API endpoint in Gokapi accepts unbounded request bodies without a size limit, which allows an authenticated user to send a maliciously large payload that triggers an out‑of‑memory condition, leading to an OOM kill of the application and complete service disruption for all users. This vulnerability represents a classic example of an unbounded resource consumption flaw, identified as CWE-400.

The vulnerability affects the open source file sharing server Gokapi, specifically versions prior to 2.2.4; users of Gokapi 2.2.3 or earlier are impacted.

The CVSS score of 6.5 indicates medium severity. EPSS is reported as under 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be an authenticated user with access to the vulnerable API endpoint; successful exploitation results in a Denial of Service that impacts all users of the affected instance.