A race condition in the share token handling allows an attacker to issue concurrent requests that each read the same download counter snapshot, pass the limit check, and obtain a copy of the file. This flaw lets an operator’s intended download cap be exceeded, potentially exhausting server resources and leading to denial of service.

goshs, a simple HTTP server written in Go by patrickhener, is vulnerable in all releases before 2.1.0. The share link feature’s download limit logic is affected.

The CVSS score of 5.9 indicates medium severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires only the ability to send multiple simultaneous requests to a share link; no privileged access or other conditions are necessary. The attack can be mitigated primarily by upgrading to the patched version.