Suse CVE-2026-30955

CVSS 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates moderate-to-high severity: the attack is remotely exploitable over the network (AV:N) with low complexity (AC:L), requires low privilege (authenticated user, PR:L), requires no user interaction (UI:N), is limited to availability impact (A:H, no confidentiality or integrity breach), and does not affect other systems (S:U). The requirement for authentication (PR:L) significantly reduces real-world attack surface compared to unauthenticated DoS vulnerabilities. However, in environments where user registration is open or internal users have malicious intent, the risk is elevated. The attack is deterministic and highly automatable (concurrent large payloads guarantee success). A patch is available (v2.2.4), indicating the vendor has acknowledged and fixed the issue. Without EPSS or KEV data in sources, we assess this as a legitimate but not critical priority: handle promptly in patching cycles, but not an emergency for defense-in-depth purposes. Organizations with strict authentication controls and small user bases face minimal real-world risk.

An authenticated user (obtained via credential compromise, insider threat, or open registration) crafts a script to send multiple concurrent HTTP POST requests to a vulnerable Gokapi API endpoint (likely a file upload or data ingestion endpoint) with multi-gigabyte payloads. Each request is not rejected due to size constraints and triggers memory allocation in the server process. Within seconds to minutes, the Gokapi process consumes available system RAM, triggering an OOM killer (Linux oom-kill, Windows memory pressure), and the service abruptly crashes. All connected users lose access to the service. Recovery requires manual server restart. No POC is explicitly mentioned in the provided intelligence, but the attack is trivial to construct given the vulnerability's deterministic nature (curl/wget with large input file repeated in parallel). Attacker requires only a valid account and network access to the API endpoint.