CVE-2026-43981

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is explicitly not goroutine-safe, concurrent requests race on the shared state causing Lua VM corruption. The Go race detector confirms this immediately under modest concurrency (ab -n 1000 -c 100). This vulnerability is fixed in 1.17.6.

CVSS

No CVSS.

References

Link	Resource
https://github.com/xyproto/algernon/issues/172
https://github.com/xyproto/algernon/security/advisories/GHSA-rr2f-4wrm-h6rg

Configurations

No configuration.

History

24 Jul 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Algernon es un pequeño servidor web autónomo y puramente Go. Antes de la versión 1.17.6, en engine/luahandler.go, el sync.RWMutex que protege LoadCommonFunctions se libera antes de que se ejecuten L.Push() y L.PCall(). Dado que el LState de gopher-lua no es explícitamente seguro para goroutines, las solicitudes concurrentes compiten por el estado compartido, causando corrupción de la VM de Lua. El detector de carreras de Go confirma esto inmediatamente bajo una concurrencia moderada (ab -n 1000 -c 100). Esta vulnerabilidad se corrige en la versión 1.17.6.

26 May 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-26 17:16

Updated : 2026-07-24 11:10

NVD link : CVE-2026-43981

Mitre link : CVE-2026-43981

CVE.ORG link : CVE-2026-43981

JSON object : View

Products Affected

No product.

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2026-43981", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43981", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-27T13:46:42.476250Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "xyproto", "product": "algernon", "versions": [{"status": "affected", "version": "< 1.17.6"}]}]}], "published": "2026-05-26T17:16:45.950", "references": [{"url": "https://github.com/xyproto/algernon/issues/172", "source": "security-advisories@github.com"}, {"url": "https://github.com/xyproto/algernon/security/advisories/GHSA-rr2f-4wrm-h6rg", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is explicitly not goroutine-safe, concurrent requests race on the shared state causing Lua VM corruption. The Go race detector confirms this immediately under modest concurrency (ab -n 1000 -c 100). This vulnerability is fixed in 1.17.6."}, {"lang": "es", "value": "Algernon es un peque\u00f1o servidor web aut\u00f3nomo y puramente Go. Antes de la versi\u00f3n 1.17.6, en engine/luahandler.go, el sync.RWMutex que protege LoadCommonFunctions se libera antes de que se ejecuten L.Push() y L.PCall(). Dado que el LState de gopher-lua no es expl\u00edcitamente seguro para goroutines, las solicitudes concurrentes compiten por el estado compartido, causando corrupci\u00f3n de la VM de Lua. El detector de carreras de Go confirma esto inmediatamente bajo una concurrencia moderada (ab -n 1000 -c 100). Esta vulnerabilidad se corrige en la versi\u00f3n 1.17.6."}], "lastModified": "2026-07-24T11:10:00.170", "sourceIdentifier": "security-advisories@github.com"}