What is the CVSS score of CVE-2026-50879?

CVE-2026-50879 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of linx-server are affected by CVE-2026-50879?

Andrei Marcu linx-server v2.3.8 contains a denial-of-service vulnerability in the file-upload component that allows unauthenticated remote attackers to crash or disable the service via malformed POST…

How to fix or mitigate CVE-2026-50879?

Within 24 hours: Identify all systems running linx-server v2.3.8 and determine criticality and network exposure. Within 7 days: Implement interim protections (rate limiting on upload endpoints, WAF rules blocking malformed POST requests to uploadPostHandler, and network segmentation if the service is not internet-critical). Within 30 days: Execute migration to a patched or alternative file-upload solution; evaluate community patches or security forks if available, or migrate to supported alternatives.

linx-server CVE-2026-50879

EUVD-2026-36777 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-15 mitre

GHSA-g743-m6x3-v6wm

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable upload endpoint, single crafted POST with no auth or user interaction, impact limited to availability of the linx-server process.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 13:25 vuln.today

CVSS changed

Jun 16, 2026 - 13:22 NVD

7.5 (HIGH)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

AnalysisAI

Denial of service in Andrei Marcu linx-server v2.3.8 allows remote unauthenticated attackers to crash or exhaust the file-upload service by sending a crafted POST request to the uploadPostHandler component. CVSS 3.1 rates availability impact High (7.5) with no confidentiality or integrity loss, and publicly available exploit code exists via a referenced GitHub gist, though there is no public exploit identified as actively exploited at time of analysis.

Technical ContextAI

linx-server is an open-source self-hosted file/URL/text sharing application written in Go by Andrei Marcu, originally developed to power the linx.li service. The vulnerable uploadPostHandler is the HTTP handler responsible for accepting multipart/form-data POST uploads. The root cause class is CWE-400 (Uncontrolled Resource Consumption), meaning the handler does not adequately bound the resources (memory, CPU, file descriptors, disk, or goroutines) consumed while parsing or persisting an incoming upload, so a maliciously shaped POST can drive the process into resource exhaustion. The CPE entry (cpe:2.3:a:n/a:n/a) was not populated by the reporter, but the description pins the affected build to linx-server v2.3.8.

RemediationAI

No vendor-released patch identified at time of analysis - neither the EUVD nor NVD references point to a fixed linx-server release, and the only references are the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-50879) and a POC gist (https://gist.github.com/pyuysig/807d92e6d8e7648d140d004f3b54b08b). Operators of linx-server v2.3.8 should monitor the upstream repository (github.com/andreimarcu/linx-server) for a release that hardens uploadPostHandler and upgrade as soon as it is published. In the interim, place linx-server behind a reverse proxy (nginx, Caddy, or Traefik) and enforce strict client_max_body_size / request body limits, per-IP connection and request-rate limits, and timeouts on slow POST bodies, accepting that legitimate large uploads will be rejected as a trade-off. Where public anonymous uploads are not required, restrict the upload endpoint to authenticated users or trusted source IPs via the proxy, and run the linx-server process with cgroup or systemd memory/CPU limits so a successful DoS attempt restarts the service rather than starving the host.