CVE-2026-61854 Details
Description
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.
A race condition vulnerability has been identified in VoiceSentinel, a real-time voice moderation system for Minecraft servers, affecting versions 2.2.1 through 3.3.0. The issue arises in the optional report buffer feature, where there is a conflict between the retention cleanup process and regular transcript writing. The cleanup function, '_maybe_cleanup()', operates without proper synchronization, allowing multiple cleanup processes for the same tenant to occur simultaneously. This can lead to corruption, duplication, or loss of transcript data, while also causing the report buffer to grow indefinitely, potentially exhausting disk space and crashing the host or other services sharing the same resources.
Users can upgrade to VoiceSentinel version 3.3.1, which addresses the vulnerability by implementing a per-tenant lock that synchronizes the cleanup and writing processes, ensuring that they do not interfere with each other.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jackh54/VoiceSentinel/commit/a8c9f926d19969a19d05eee2a508719aea7f109c | [email protected] | Source CodeVendor |
| https://github.com/jackh54/VoiceSentinel/releases/tag/v3.3.1 | [email protected] | Release NotesVendor |
| https://github.com/jackh54/VoiceSentinel/security/advisories/GHSA-vhqx-3242-77j7 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-667 | Improper Locking | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| VoiceSentinel | >= 2.2.1, <= 3.3.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | New CVE Received | [email protected] |