CVE-2026-48154
GoRest: InMemorySecret2FA race condition allows process crash via concurrent map access
Description
GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and write to this map concurrently, and because Go's runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand. This results in high, repeatable availability impact with no confidentiality or integrity consequences. This issue has been fixed in version 1.12.2.
INFO
Published Date :
Aug. 4, 2026, 8:16 p.m.
Last Modified :
Oct. 23, 2026, 9:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-48154
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE |
Solution
- Update GoRest to version 1.12.2 or later.
- Ensure package-level maps are synchronized.
- Review concurrent map access patterns.
- Test for proper synchronization.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-48154.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-48154 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-48154
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48154 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-48154 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: gorest de pilinux, Description: GoRest es un kit de inicio de Golang construido con el framework Gin para la creación de prototipos y el desarrollo de APIs RESTful. En versiones anteriores a la 1.12.2, nMemorySecret2FA contiene una condición de carrera debido a un mapa a nivel de paquete no sincronizado utilizado para almacenar secretos 2FA. Múltiples gestores HTTP en handler/login.go y handler/twoFA.go leen y escriben en este mapa de forma concurrente, y debido a que el tiempo de ejecución de Go trata el acceso concurrente no sincronizado al mapa como un error fatal irrecuperable, un atacante puede desencadenar repetidamente esta condición para bloquear el proceso bajo demanda. Esto resulta en un impacto alto y repetible en la disponibilidad sin consecuencias para la confidencialidad o la integridad. Este problema ha sido solucionado en la versión 1.12.2. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 05, 2026
Action Type Old Value New Value Added Reference https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg Added SSVC {'id': 'CVE-2026-48154', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-05T19:36:32.320558Z'} -
New CVE Received by [email protected]
Aug. 04, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'pilinux', 'product': 'gorest', 'versions': [{'status': 'affected', 'version': '< 1.12.2'}]}] Added Description GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and write to this map concurrently, and because Go's runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand. This results in high, repeatable availability impact with no confidentiality or integrity consequences. This issue has been fixed in version 1.12.2. Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-362 Added Reference https://github.com/pilinux/gorest/commit/117ff55fc21b47442da07c44c30b403af2da407b Added Reference https://github.com/pilinux/gorest/pull/391 Added Reference https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg