This release includes 2 security fixes for security teams reviewing exposed deployments.
Topics
+14 more
Affected surfaces
ReleasePort's take
Moderate signalVersion v2.1.0 resolves a Share‑link token race condition and ensures WebDAV listeners honor read‑only, upload‑only, and no‑delete flags.
Why it matters: Fixes GHSA-j48m-h7xq-2xpj (severity 90) preventing download‑limit races; fixes GHSA-3whc-qvhv-xqjp (severity 85) making WebDAV flag enforcement reliable.
Summary
AI summarySecurity fixes for Share‑link race and WebDAV flag handling, bug fixes across multiple modules, and project repository relocation.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixes GHSA-j48m-h7xq-2xpj: prevents Share-link token redemption races past download limit. Fixes GHSA-j48m-h7xq-2xpj: prevents Share-link token redemption races past download limit. Source: llm_adapter@2026-05-29 Confidence: high |
— |
| Security | High |
Fixes GHSA-3whc-qvhv-xqjp: WebDAV listener now respects --read-only, --upload-only, and --no-delete flags. Fixes GHSA-3whc-qvhv-xqjp: WebDAV listener now respects --read-only, --upload-only, and --no-delete flags. Source: llm_adapter@2026-05-29 Confidence: high |
— |
| Bugfix | Medium |
WebSocket handlers enforce same‑host origin check, rejecting cross‑origin connections. WebSocket handlers enforce same‑host origin check, rejecting cross‑origin connections. Source: llm_adapter@2026-05-29 Confidence: high |
— |
| Bugfix | Medium |
Catcher session IDs upgraded to 128‑bit crypto/rand values, eliminating predictability and collisions. Catcher session IDs upgraded to 128‑bit crypto/rand values, eliminating predictability and collisions. Source: llm_adapter@2026-05-29 Confidence: high |
— |
| Bugfix | Medium |
Default reply IP set in DNS server constructor, fixing race on concurrent requests. Default reply IP set in DNS server constructor, fixing race on concurrent requests. Source: llm_adapter@2026-05-29 Confidence: high |
— |
| Bugfix | Medium |
SFTP `Setstat` no longer applies chmod 000 when mode attribute is omitted. SFTP `Setstat` no longer applies chmod 000 when mode attribute is omitted. Source: llm_adapter@2026-05-29 Confidence: high |
— |
| Bugfix | Medium |
LDAP `readTLV()` now enforces a 1 MB size guard to avoid unbounded memory allocation on malformed packets. LDAP `readTLV()` now enforces a 1 MB size guard to avoid unbounded memory allocation on malformed packets. Source: llm_adapter@2026-05-29 Confidence: high |
— |
| Bugfix | Medium |
Clipboard store now uses sync.RWMutex to avoid race conditions on concurrent reads/writes. Clipboard store now uses sync.RWMutex to avoid race conditions on concurrent reads/writes. Source: llm_adapter@2026-05-29 Confidence: low |
— |
| Bugfix | Medium |
Auth cache replaced with time‑based expiry map, preventing unbounded memory growth. Auth cache replaced with time‑based expiry map, preventing unbounded memory growth. Source: llm_adapter@2026-05-29 Confidence: low |
— |
| Bugfix | Medium |
Context menu "Open" always opens target in a new browser tab instead of toggling preview/navigation based on file type. Context menu "Open" always opens target in a new browser tab instead of toggling preview/navigation based on file type. Source: granite4.1:30b@2026-05-29-audit Confidence: low |
— |
| Bugfix | Low |
Corrected internal chunkSize from 256 MB back to the intended 16 MB. Corrected internal chunkSize from 256 MB back to the intended 16 MB. Source: llm_adapter@2026-05-29 Confidence: high |
— |
Full changelog
What Changed in v2.1.0
Security fixes
- GHSA-j48m-h7xq-2xpj — Fixed Share-link ?token=… redemption races past download limit
- GHSA-3whc-qvhv-xqjp — Fixed WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
Bug fixes
- Context menu "Open" (#166) — The right-click "Open" action now always opens the target in a new browser tab instead of toggling between preview and navigation depending on file type
- Clipboard data race — Added
sync.RWMutexto the clipboard store; concurrent reads and writes no longer cause a race condition - Auth cache — Replaced the unbounded boolean auth cache with a time-based expiry map, preventing unbounded memory growth on repeated auth attempts
- WebSocket origin check — Both the main WebSocket handler and the catcher WebSocket now enforce a same-host origin check, rejecting cross-origin connections
- Catcher session IDs — Session IDs upgraded from 32-bit + timestamp to 128-bit
crypto/rand, eliminating predictability and timestamp-based collisions - DNS server data race — Default reply IP is now set in the constructor rather than the handler, fixing a race on concurrent DNS requests
- SFTP
Setstat—chmod 000no longer applied when aSetstatrequest omits the mode attribute - LDAP TLV read — Added a 1 MB size guard in
readTLV()to prevent unbounded memory allocation on malformed LDAP packets - Chunk size constant — Corrected internal
chunkSizefrom 256 MB to the intended 16 MB
Project
- Repository moved to github.com/goshs-labs/goshs
- Security contributor acknowledgement: @black-shadow-007
Dependencies
- Bumped
github/codeql-actionto 4.36.0
Security Fixes
- GHSA-j48m-h7xq-2xpj — Fixed Share‑link ?token=… redemption races past download limit
- GHSA-3whc-qvhv-xqjp — Fixed WebDAV listener ignores --read-only, --upload-only, and --no-delete mode flags
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Goshs
All releases →Beta — feedback welcome: [email protected]