CVE-2026-50139

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, "ShareHandler" reads the share token's "DownloadLimit" under "RLock", releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same "Downloaded"/"DownloadLimit"...

CVE-2026-50139: Concurrent Execution using Shared Resource with Improper Synchronization

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...