CVE-2026-48154

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48154", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T23:12:43.031Z", "datePublished": "2026-08-04T19:45:51.909Z", "dateUpdated": "2026-08-05T19:48:20.202Z"}, "containers": {"cna": {"title": "GoRest: InMemorySecret2FA race condition allows process crash via concurrent map access", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg"}, {"name": "https://github.com/pilinux/gorest/pull/391", "tags": ["x_refsource_MISC"], "url": "https://github.com/pilinux/gorest/pull/391"}, {"name": "https://github.com/pilinux/gorest/commit/117ff55fc21b47442da07c44c30b403af2da407b", "tags": ["x_refsource_MISC"], "url": "https://github.com/pilinux/gorest/commit/117ff55fc21b47442da07c44c30b403af2da407b"}], "affected": [{"vendor": "pilinux", "product": "gorest", "versions": [{"version": "< 1.12.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-04T19:45:51.909Z"}, "descriptions": [{"lang": "en", "value": "GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and write to this map concurrently, and because Go's runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand. This results in high, repeatable availability impact with no confidentiality or integrity consequences. This issue has been fixed in version 1.12.2."}], "source": {"advisory": "GHSA-cpwg-x64r-rgwg", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T19:36:32.320558Z", "id": "CVE-2026-48154", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T19:48:20.202Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48154", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T19:36:32.320558Z"}}}], "references": [{"url": "https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T19:36:49.615Z"}}], "cna": {"title": "GoRest: InMemorySecret2FA race condition allows process crash via concurrent map access", "source": {"advisory": "GHSA-cpwg-x64r-rgwg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "pilinux", "product": "gorest", "versions": [{"status": "affected", "version": "< 1.12.2"}]}], "references": [{"url": "https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg", "name": "https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pilinux/gorest/pull/391", "name": "https://github.com/pilinux/gorest/pull/391", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pilinux/gorest/commit/117ff55fc21b47442da07c44c30b403af2da407b", "name": "https://github.com/pilinux/gorest/commit/117ff55fc21b47442da07c44c30b403af2da407b", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and write to this map concurrently, and because Go's runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand. This results in high, repeatable availability impact with no confidentiality or integrity consequences. This issue has been fixed in version 1.12.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-04T19:45:51.909Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48154", "state": "PUBLISHED", "dateUpdated": "2026-08-05T19:48:20.202Z", "dateReserved": "2026-05-20T23:12:43.031Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-04T19:45:51.909Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gorest", "vendor": "pilinux", "versions": [{"status": "affected", "version": "< 1.12.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and write to this map concurrently, and because Go's runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand. This results in high, repeatable availability impact with no confidentiality or integrity consequences. This issue has been fixed in version 1.12.2."}, {"lang": "es", "value": "GoRest es un kit de inicio de Golang construido con el framework Gin para la creaci\u00f3n de prototipos y el desarrollo de APIs RESTful. En versiones anteriores a la 1.12.2, nMemorySecret2FA contiene una condici\u00f3n de carrera debido a un mapa a nivel de paquete no sincronizado utilizado para almacenar secretos 2FA. M\u00faltiples gestores HTTP en handler/login.go y handler/twoFA.go leen y escriben en este mapa de forma concurrente, y debido a que el tiempo de ejecuci\u00f3n de Go trata el acceso concurrente no sincronizado al mapa como un error fatal irrecuperable, un atacante puede desencadenar repetidamente esta condici\u00f3n para bloquear el proceso bajo demanda. Esto resulta en un impacto alto y repetible en la disponibilidad sin consecuencias para la confidencialidad o la integridad. Este problema ha sido solucionado en la versi\u00f3n 1.12.2."}], "id": "CVE-2026-48154", "lastModified": "2026-10-23T21:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48154", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T19:36:32.320558Z", "version": "2.0.3"}}]}, "published": "2026-08-04T20:16:52.017", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/pilinux/gorest/commit/117ff55fc21b47442da07c44c30b403af2da407b"}, {"source": "security-advisories@github.com", "url": "https://github.com/pilinux/gorest/pull/391"}, {"source": "security-advisories@github.com", "url": "https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.12.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "gorest", "source": "cna", "vendor": "pilinux"}, "product": "gorest", "vendor": "pilinux"}], "created": "2026-08-04T21:30:12.502451+00:00", "updated": "2026-08-05T10:19:00.241511+00:00", "vendors": ["pilinux", "pilinux$PRODUCT$gorest"]}