Executive brief
A race condition in the gorest API boilerplate can cause the entire application to crash when multiple users attempt to log in or manage two-factor authentication (2FA) simultaneously. This occurs because the system handles 2FA data in memory without proper coordination between concurrent requests. An attacker could intentionally trigger this crash to disrupt service availability for all users.
Technical details
A CWE-362 race condition exists in the InMemorySecret2FA component of the pilinux/gorest Go REST API boilerplate. The vulnerability stems from unsynchronized concurrent access to a global Go map (map[uint64]Secret2FA) used for storing 2FA secrets. When multiple HTTP goroutines attempt to read, write, or delete from this map simultaneously—such as during concurrent logins or 2FA setup—the Go runtime detects the race and triggers a fatal error, resulting in an immediate process crash (DoS). The issue was resolved in version 1.12.2 by implementing a thread-safe store using sync.RWMutex and deep-copying data to prevent external mutation.
Affected products
- pilinux gorest <= 1.12.1
Timeline
- 2026-05-21: disclosed: Advisory published by vendor
- 2026-06-12: advisory: GitHub Advisory published and reviewed