Live › vulnerability › CVE-2026-61854
VoiceSentinel, a voice moderation system for Minecraft servers, has a race between retention cleanup and transcript writes in its optional report buffer. Racing writes can lose or corrupt transcript data and stop retention pruning, so disk usage can grow until storage is exhausted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Only servers running VoiceSentinel from 2.2.1 up to 3.3.1 with the opt-in report buffer turned on are exposed. The risk is higher with two or more processing workers and with public-pool servers sharing a server key. Servers with the report buffer disabled, the default, are not affected.
No product ranges from the sources yet.
2.2.1 and 3.3.1report_buffer.enabled is set to true in the configprocessing.worker_count is 2 or higher3.3.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In report_buffer.py, _maybe_cleanup() uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous _cleanup_tenant() operations for one tenant. Cleanup reads transcripts.jsonl and rewrites it in place without file locking or atomic replacement, while report_buffer_append_async uses asyncio.to_thread to append without synchronization. In main.py, concurrent _processing_worker tasks make this reachable in normal operation; processing.worker_count of two or more and public-pool servers sharing a server_key increase collisions. With report_buffer.enabled set to true, racing writes can lose, duplicate or corrupt transcript data and defeat report_buffer.retention_seconds pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-61854")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.