Skip to content

Race Condition in handle() shared LState

High
xyproto published GHSA-rr2f-4wrm-h6rg May 5, 2026

Package

No package listed

Affected versions

< 1.17.6

Patched versions

1.17.6

Description

In engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is explicitly not goroutine-safe, concurrent requests race on the shared state causing Lua VM corruption. The Go race detector confirms this immediately under modest concurrency (ab -n 1000 -c 100).

Impact

Denial of service when using Lua + Algernon.

Patches

Has been patched in version 1.17.6.

Workarounds

Not that I know of.

References

#172

Severity

High

CVE ID

CVE-2026-43981

Weaknesses

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. Learn more on MITRE.

Credits