CVE-2026-48154 Details
Description
GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and write to this map concurrently, and because Go's runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand. This results in high, repeatable availability impact with no confidentiality or integrity consequences. This issue has been fixed in version 1.12.2.
A race condition vulnerability has been identified in GoRest, a Golang starter kit for developing RESTful APIs with the Gin framework. This vulnerability exists in versions prior to 1.12.2, within the 'InMemorySecret2FA' component, which is a package-level map used to store two-factor authentication (2FA) secrets. The vulnerability arises from unsynchronized concurrent access to this map by multiple HTTP handlers, specifically in 'handler/login.go' and 'handler/twoFA.go'. Go's runtime treats such unsynchronized access to maps as a critical error, leading to a process crash. This vulnerability has a high impact on availability, allowing an attacker to disrupt the service by causing repeated crashes, while posing no risks to confidentiality or integrity.
Users can upgrade to GoRest version 1.12.2 or later, where this vulnerability has been fixed. The patch involves replacing the bare map with a synchronized version that uses 'sync.RWMutex' to manage concurrent access, preventing the race condition.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/pilinux/gorest/commit/117ff55fc21b47442da07c44c30b403af2da407b | [email protected] | Source CodeVendor |
| https://github.com/pilinux/gorest/pull/391 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pilinux/gorest | < 1.12.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |