CyberRota Analysis
AI-GeneratedThe vulnerability affects the goshs SimpleHTTPServer prior to version 2.1.0, where the `ShareHandler` improperly manages concurrent requests, allowing multiple downloads to exceed the intended `DownloadLimit`. This can lead to unintentional over-distribution of files, potentially impacting bandwidth and resource allocation. Operators using affected versions should prioritize upgrading to version 2.1.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, `ShareHandler` reads the share token's `DownloadLimit` under `RLock`, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same `Downloaded`/`DownloadLimit` snapshot, all pass the check, and all are served — exceeding the operator's intended cap. Version 2.1.0 patches the issue.