Race condition in VoiceSentinel report buffer can corrupt transcripts
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.
Summary
VoiceSentinel from 2.2.1 before 3.3.1 has a race condition in its optional report buffer feature (CWE-362). Cleanup rewrites transcripts.jsonl without file locking or atomic replacement, while transcript writes append to it concurrently, which happens in normal operation with multiple processing workers. With report_buffer.enabled set to true, racing writes can lose, duplicate or corrupt transcript data and defeat retention pruning, allowing unbounded disk growth that can exhaust storage and crash the host. The feature is disabled by default.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Update VoiceSentinel to version 3.3.1.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA VoiceSentinel (jackh54) Fixed in 3.3.1
Timeline
- 2026-10-30 Threatist record created from CVE-2026-61854
- 2026-11-01 Priority changed: MEDIUM → LOW
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences