Read the docs
TI-2026-83292 Aliases CVE-2026-61854

Race condition in VoiceSentinel report buffer can corrupt transcripts

Priority LOW 35CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

VoiceSentinel from 2.2.1 before 3.3.1 has a race condition in its optional report buffer feature (CWE-362). Cleanup rewrites transcripts.jsonl without file locking or atomic replacement, while transcript writes append to it concurrently, which happens in normal operation with multiple processing workers. With report_buffer.enabled set to true, racing writes can lose, duplicate or corrupt transcript data and defeat retention pruning, allowing unbounded disk growth that can exhaust storage and crash the host. The feature is disabled by default.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.

Why it matters now

EPSS 0.00243 15th percentileScored 2026-11-07
Fix Fixed VoiceSentinel (jackh54): 3.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
jackh54VoiceSentinel2.2.1 to before 3.3.13.3.1Patch availableCNA
  • VoiceSentinel Vendorjackh54 Affected 2.2.1 to before 3.3.1 Fixed in 3.3.1 Patch available CNA

Remediation

Update VoiceSentinel to version 3.3.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA VoiceSentinel (jackh54) Fixed in 3.3.1

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-61854
  2. 2026-11-01 Priority changed: MEDIUM → LOW

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences