Threats tagged 'ghsa-j48m-h7xq-2xpj'

The goshs package (version 2.0.9 and earlier) contains a race condition in its share-link token redemption logic. The flaw allows concurrent requests to bypass the intended download limit on shared files, enabling multiple downloads of a supposedly single-use share link. This occurs because the download count is incremented only after serving the file, allowing multiple goroutines to read the same download count before it is updated. The issue is fixed in version 2.1.0.