PatchSiren cyber security CVE debrief
CVE-2026-43981 xyproto CVE debrief
A race condition in Algernon, a self-contained pure-Go web server, allows concurrent requests to corrupt the shared Lua VM state. The vulnerability exists in engine/luahandler.go where the sync.RWMutex protecting LoadCommonFunctions is released before gopher-lua's L.Push() and L.PCall() operations complete. Since gopher-lua's LState is explicitly not goroutine-safe, this premature unlock enables data races on the shared Lua state under concurrent load. The Go race detector confirms this behavior under modest concurrency (100 concurrent connections). This is a HIGH severity vulnerability with CVSS 8.2, primarily impacting availability through VM corruption. The issue was fixed in Algernon version 1.17.6.
- Vendor
- xyproto
- Product
- algernon
- CVSS
- HIGH 8.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-26
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-26
- Advisory updated
- 2026-05-26
Who should care
Organizations running Algernon web servers with Lua scripting enabled, particularly those handling concurrent requests. DevOps teams managing Go-based web infrastructure. Security teams monitoring for availability-impacting race conditions in interpreted language embeddings.
Technical summary
The vulnerability stems from incorrect mutex lifecycle management in Algernon's Lua handler. The sync.RWMutex is unlocked before gopher-lua state manipulation completes, violating gopher-lua's thread-safety requirements. Under concurrent HTTP requests (demonstrated with 100 concurrent connections), multiple goroutines race on the shared LState, causing memory corruption and VM instability. The fix in 1.17.6 extends mutex coverage to encompass the complete L.Push() and L.PCall() execution window.
Defensive priority
HIGH
Recommended defensive actions
- Upgrade Algernon to version 1.17.6 or later to eliminate the race condition
- If immediate patching is not possible, limit concurrent request handling to single-threaded operation or implement request serialization for Lua-handled endpoints
- Enable Go race detector in staging environments to identify similar concurrency issues: `go run -race` or `go test -race`
- Review custom Lua handler implementations for similar premature unlock patterns
- Monitor application logs for Lua VM crashes or corruption indicators that may signal exploitation attempts
Evidence notes
CVE description confirms race condition in engine/luahandler.go with premature RWMutex release before L.Push()/L.PCall(). Go race detector validation cited. Fix version 1.17.6 confirmed. CVSS 4.0 vector AV:N/AC:H/AT:N/PR:N/UI:N/VA:H indicates network-accessible, high attack complexity, no privileges required, high availability impact. CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) classified by GitHub Security Advisories.
Official resources
2026-05-26T17:16:45.950Z