ByteOS Network

CVE Vulnerability Details :

CVE-2026-43981

PUBLISHED

More Info Official Page

Assigner-GitHub_M

Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa

Published At-26 May, 2026 | 16:31

Updated At-26 May, 2026 | 16:31

▼CVE Numbering Authority (CNA)

Algernon: Race Condition in handle() shared LState

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is explicitly not goroutine-safe, concurrent requests race on the shared state causing Lua VM corruption. The Go race detector confirms this immediately under modest concurrency (ab -n 1000 -c 100). This vulnerability is fixed in 1.17.6.

Affected Products

Vendor

xyproto

Product

algernon

Versions

Affected

< 1.17.6

Problem Types

Type	CWE ID	Description
CWE	CWE-362	CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Type: CWE

CWE ID: CWE-362

Description: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Metrics

Version	Base score	Base severity	Vector
4.0	8.2	HIGH	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Version: 4.0

Base score: 8.2

Base severity: HIGH

Vector:

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

Hyperlink	Resource
https://github.com/xyproto/algernon/security/advisories/GHSA-rr2f-4wrm-h6rg	x_refsource_CONFIRM
https://github.com/xyproto/algernon/issues/172	x_refsource_MISC

Hyperlink: https://github.com/xyproto/algernon/security/advisories/GHSA-rr2f-4wrm-h6rg

Resource:

x_refsource_CONFIRM

Hyperlink: https://github.com/xyproto/algernon/issues/172

Resource:

x_refsource_MISC

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References