{"id":"CVE-2026-48154","sourceIdentifier":"security-advisories@github.com","published":"2026-08-04T20:16:52.017","lastModified":"2026-10-23T21:10:00.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and write to this map concurrently, and because Go's runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand. This results in high, repeatable availability impact with no confidentiality or integrity consequences. This issue has been fixed in version 1.12.2."},{"lang":"es","value":"GoRest es un kit de inicio de Golang construido con el framework Gin para la creación de prototipos y el desarrollo de APIs RESTful. En versiones anteriores a la 1.12.2, nMemorySecret2FA contiene una condición de carrera debido a un mapa a nivel de paquete no sincronizado utilizado para almacenar secretos 2FA. Múltiples gestores HTTP en handler/login.go y handler/twoFA.go leen y escriben en este mapa de forma concurrente, y debido a que el tiempo de ejecución de Go trata el acceso concurrente no sincronizado al mapa como un error fatal irrecuperable, un atacante puede desencadenar repetidamente esta condición para bloquear el proceso bajo demanda. Esto resulta en un impacto alto y repetible en la disponibilidad sin consecuencias para la confidencialidad o la integridad. Este problema ha sido solucionado en la versión 1.12.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"pilinux","product":"gorest","versions":[{"version":"< 1.12.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-05T19:36:32.320558Z","id":"CVE-2026-48154","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://github.com/pilinux/gorest/commit/117ff55fc21b47442da07c44c30b403af2da407b","source":"security-advisories@github.com"},{"url":"https://github.com/pilinux/gorest/pull/391","source":"security-advisories@github.com"},{"url":"https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg","source":"security-advisories@github.com"},{"url":"https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}