https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 17:24:33 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-48154 <p>GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and write to this map concurrently, and because Go&#39;s runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand. This results in high, repeatable availability impact with no confidentiality or integrity consequences. This issue has been fixed in version 1.12.2.</p> <p>GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and write to this map concurrently, and because Go&#39;s runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand. This results in high, repeatable availability impact with no confidentiality or integrity consequences. This issue has been fixed in version 1.12.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-48154 https://db.gcve.eu/vuln/ghsa-cpwg-x64r-rgwg <p><strong>Affected:</strong> Go: github.com/pilinux/gorest</p> <p>## Vulnerability: CWE-362 — Concurrent Map Access Race Condition in InMemorySecret2FA</p> <p>**CWE:** CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization)</p> <p>### Affected Component - `github.com/pilinux/gorest` — Go REST API boilerplate - InMemorySecret2FA — in-memory 2FA secret store</p> <p>### Vulnerability Locations</p> <p>| File | Line | Role | |------|------|------| | `database/model/twoFA.go` | 43 | Global `map[uint64]Secret2FA` — bare map, no sync.RWMutex | | `handler/login.go` | 139 | Map write during user login | | `handler/twoFA.go` | 205 | Map write during 2FA setup | | `handler/twoFA.go` | 272 | Map write during 2FA activation | | `handler/twoFA.go` | 575 | Map write during 2FA verification | | `handler/twoFA.go` | 189 | Map read during 2FA operations | | `handler/twoFA.go` | 245 | Map read during 2FA operations | | `handler/twoFA.go` | 491 | Map read during 2FA operations | | `service/common.go` | 79 | Map delete |</p> <p>### Data Flow</p> <p>``` Multiple HTTP goroutines (concurrent requests) │ ├── handler/login.go:139 ─► map write ──┐ ├── handler/twoFA.go:205 ─► map write ──┼── InMemorySecret2FA (bare map) ├── handler/twoFA.go:189 ─► map read ───┤ ▲ NO sync.RWMutex ├── handler/twoFA.go:245 ─► map read ───┤ │ ├── handler/twoFA.go:491 ─► map read ───┤ │ └── service/common.go:79 ─► map delete ─┘ │ │ Go runtime detects concurrent map │ read…</p> <p><strong>Affected:</strong> Go: github.com/pilinux/gorest</p> <p>## Vulnerability: CWE-362 — Concurrent Map Access Race Condition in InMemorySecret2FA</p> <p>**CWE:** CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization)</p> <p>### Affected Component - `github.com/pilinux/gorest` — Go REST API boilerplate - InMemorySecret2FA — in-memory 2FA secret store</p> <p>### Vulnerability Locations</p> <p>| File | Line | Role | |------|------|------| | `database/model/twoFA.go` | 43 | Global `map[uint64]Secret2FA` — bare map, no sync.RWMutex | | `handler/login.go` | 139 | Map write during user login | | `handler/twoFA.go` | 205 | Map write during 2FA setup | | `handler/twoFA.go` | 272 | Map write during 2FA activation | | `handler/twoFA.go` | 575 | Map write during 2FA verification | | `handler/twoFA.go` | 189 | Map read during 2FA operations | | `handler/twoFA.go` | 245 | Map read during 2FA operations | | `handler/twoFA.go` | 491 | Map read during 2FA operations | | `service/common.go` | 79 | Map delete |</p> <p>### Data Flow</p> <p>``` Multiple HTTP goroutines (concurrent requests) │ ├── handler/login.go:139 ─► map write ──┐ ├── handler/twoFA.go:205 ─► map write ──┼── InMemorySecret2FA (bare map) ├── handler/twoFA.go:189 ─► map read ───┤ ▲ NO sync.RWMutex ├── handler/twoFA.go:245 ─► map read ───┤ │ ├── handler/twoFA.go:491 ─► map read ───┤ │ └── service/common.go:79 ─► map delete ─┘ │ │ Go runtime detects concurrent map │ read…</p> https://db.gcve.eu/vuln/ghsa-cpwg-x64r-rgwg