Description (CNA)
Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is explicitly not goroutine-safe, concurrent requests race on the shared state causing Lua VM corruption. The Go race detector confirms this immediately under modest concurrency (ab -n 1000 -c 100). This vulnerability is fixed in 1.17.6.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| xyproto / algernon | affected < 1.17.6 |
CWE
CWE-362
References
- https://github.com/xyproto/algernon/security/advisories/GHSA-rr2f-4wrm-h6rg
- https://github.com/xyproto/algernon/issues/172
ADP enrichment
No English description supplied.
No references supplied.