PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-43981 xyproto CVE debrief

A race condition in Algernon, a self-contained pure-Go web server, allows concurrent requests to corrupt the shared Lua VM state. The vulnerability exists in engine/luahandler.go where the sync.RWMutex protecting LoadCommonFunctions is released before gopher-lua's L.Push() and L.PCall() operations complete. Since gopher-lua's LState is explicitly not goroutine-safe, this premature unlock enables data races on the shared Lua state under concurrent load. The Go race detector confirms this behavior under modest concurrency (100 concurrent connections). This is a HIGH severity vulnerability with CVSS 8.2, primarily impacting availability through VM corruption. The issue was fixed in Algernon version 1.17.6.

Vendor
xyproto
Product
algernon
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-26
Advisory published
2026-05-26
Advisory updated
2026-05-26

Who should care

Organizations running Algernon web servers with Lua scripting enabled, particularly those handling concurrent requests. DevOps teams managing Go-based web infrastructure. Security teams monitoring for availability-impacting race conditions in interpreted language embeddings.

Technical summary

The vulnerability stems from incorrect mutex lifecycle management in Algernon's Lua handler. The sync.RWMutex is unlocked before gopher-lua state manipulation completes, violating gopher-lua's thread-safety requirements. Under concurrent HTTP requests (demonstrated with 100 concurrent connections), multiple goroutines race on the shared LState, causing memory corruption and VM instability. The fix in 1.17.6 extends mutex coverage to encompass the complete L.Push() and L.PCall() execution window.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Algernon to version 1.17.6 or later to eliminate the race condition
  • If immediate patching is not possible, limit concurrent request handling to single-threaded operation or implement request serialization for Lua-handled endpoints
  • Enable Go race detector in staging environments to identify similar concurrency issues: `go run -race` or `go test -race`
  • Review custom Lua handler implementations for similar premature unlock patterns
  • Monitor application logs for Lua VM crashes or corruption indicators that may signal exploitation attempts

Evidence notes

CVE description confirms race condition in engine/luahandler.go with premature RWMutex release before L.Push()/L.PCall(). Go race detector validation cited. Fix version 1.17.6 confirmed. CVSS 4.0 vector AV:N/AC:H/AT:N/PR:N/UI:N/VA:H indicates network-accessible, high attack complexity, no privileges required, high availability impact. CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) classified by GitHub Security Advisories.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-43981 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-43981

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-43981 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43981

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.