{"cve":"CVE-2026-48154","nvd":{"published":"2026-08-04T20:16:52.017","modified":"2026-10-23T21:10:00.157","status":"Deferred","description":"GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and write to this map concurrently, and because Go's runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand. This results in high, repeatable availability impact with no confidentiality or integrity consequences. This issue has been fixed in version 1.12.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9},"cwes":["CWE-362"],"references":["https://github.com/pilinux/gorest/commit/117ff55fc21b47442da07c44c30b403af2da407b","https://github.com/pilinux/gorest/pull/391","https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg","https://github.com/pilinux/gorest/security/advisories/GHSA-cpwg-x64r-rgwg"],"products":[],"source":"nvd","synced_at":"2026-10-24T16:53:34.184483516+00:00"},"epss":{"cve":"CVE-2026-48154","score":0.00398,"percentile":0.3375,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-cpwg-x64r-rgwg","url":"https://osv.dev/vulnerability/GHSA-cpwg-x64r-rgwg","summary":"gorest InMemorySecret2FA race condition allows process crash via concurrent map access (CWE-362)","modified":"2026-06-25T19:56:01.308420243Z","packages":[{"ecosystem":"Go","name":"github.com/pilinux/gorest","purl":"pkg:golang/github.com/pilinux/gorest","ranges":["<1.12.2"],"fixed":["1.12.2"]}]},{"id":"GO-2026-5330","url":"https://osv.dev/vulnerability/GO-2026-5330","summary":"gorest InMemorySecret2FA race condition allows process crash via concurrent map access (CWE-362) in github.com/pilinux/gorest","modified":"2026-06-25T19:45:31.827870187Z","packages":[{"ecosystem":"Go","name":"github.com/pilinux/gorest","purl":"pkg:golang/github.com/pilinux/gorest","ranges":["<1.12.2"],"fixed":["1.12.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}