CVE-2026-48154
Received Received - Intake

Race Condition in GoRest Starter Kit Leads to Process Crash

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: GitHub, Inc.

Description
GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and write to this map concurrently, and because Go's runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand. This results in high, repeatable availability impact with no confidentiality or integrity consequences. This issue has been fixed in version 1.12.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-05
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-48154
EUVD
EUVD-2026-52883

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pilinux gorest to 1.12.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48154 is a race condition vulnerability in GoRest, a Golang starter kit using the Gin framework. It involves an unsynchronized global map called nMemorySecret2FA that stores 2FA secrets. Multiple HTTP handlers access this map concurrently without synchronization, causing the Go runtime to detect unrecoverable fatal errors and crash the process. This leads to repeatable denial of service with no impact on confidentiality or integrity.

Detection Guidance

Detecting this vulnerability requires checking if your GoRest application uses versions prior to 1.12.2 and if the InMemorySecret2FA map is accessed without synchronization. Monitor for fatal errors or crashes during concurrent login or 2FA operations. Check logs for Go runtime panics indicating concurrent map access.

Impact Analysis

The vulnerability can cause repeated service crashes when multiple users with 2FA log in simultaneously or when login overlaps with 2FA verification. This results in high availability impact, making the service unavailable on demand. There is no risk to data confidentiality or integrity.

Compliance Impact

This vulnerability primarily impacts availability, causing service disruptions. While it does not directly affect confidentiality or integrity, repeated outages could lead to non-compliance with availability requirements in GDPR, HIPAA, or other regulations that mandate reliable access to systems handling sensitive data.

Mitigation Strategies

Upgrade GoRest to version 1.12.2 or later. Replace direct map access with the thread-safe Secret2FAStore implementation. Ensure all handlers and services use the new Get, Set, and Delete methods. Review and update code to avoid unsynchronized concurrent map operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48154. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart