Executive brief
Algernon is a standalone web server that allows developers to use the Lua programming language for web logic. A flaw in how the server handles multiple simultaneous requests can lead to internal memory corruption within its Lua engine. In practice, an attacker or even heavy legitimate traffic can cause the web server to crash or behave unpredictably, resulting in a denial of service.
Technical details
A race condition exists in 'engine/luahandler.go' due to improper synchronization of the gopher-lua LState. The 'sync.RWMutex' protecting 'LoadCommonFunctions' is released prematurely before 'L.Push()' and 'L.PCall()' are executed. Because the underlying Lua state is not thread-safe, concurrent network requests can access the shared state simultaneously, leading to Lua VM corruption. This vulnerability allows a remote attacker to trigger a denial of service (DoS) by sending concurrent requests. The issue is resolved in version 1.17.6.
Affected products
- xyproto Algernon < 1.17.6
Timeline
- 2026-04-19: disclosed: Initial report to maintainer
- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-05-26: patched: Fix released in version 1.17.6