Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/pilinux/gorest

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9GoPublished

    gorest InMemorySecret2FA race condition allows process crash via concurrent map access (CWE-362)

    CVE-2026-48154 · GHSA-cpwg-x64r-rgwg

    Affected
    • Go github.com/pilinux/gorest <= 1.12.1
    Fixed in
    1.12.2· Vendor fix available
    Issue
    Vulnerability: CWE-362 — Concurrent Map Access Race Condition in InMemorySecret2FA CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) Affected Component - github.com/pilinux/gorest — Go REST API boilerplate - InMemorySecret2FA — in-memory 2FA secret store Vulnerability Locations | File | Line | Role | |------|------|------| | database/model/twoFA.go | 43 | Global map[uint64]Secret2FA — bare map, no sync.RWMutex | | handler/login.go | 139 | Map write during user login | | handler/twoFA.go | 205 | Map write during 2FA setup | | handler/twoFA.go | 272 | Map write during 2FA activation | | handler/twoFA.go | 575 | Map write during 2FA verification | | handler/twoFA.go | 189 | Map read during 2FA operations | | handler/twoFA.go | 245 | Map read during 2FA operations | | handler/twoFA.go | 491 | Map read during 2FA operations | | service/common.go | 79 | Map delete | Data Flow Description The InMemorySecret2FA in database/model/twoFA.go was defined as a…

    Recommended action: Upgrade to 1.12.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →