---
id: "CVE-2026-61854"
kind: "vulnerability"
aliases: ["CVE-2026-61854"]
title: "VoiceSentinel: race in report buffer cleanup can corrupt transcripts and fill disk"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["minecraft", "package", "python", "self-hosted", "voicesentinel"]
not_affected_if: ["default-config", "report-buffer-disabled"]
published_at: "2026-10-30T19:18:28+00:00"
first_seen_at: "2026-10-30T19:25:29+00:00"
updated_at: "2026-10-30T19:25:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61854", "first_seen_at": "2026-10-30T19:25:29+00:00"}]
---

# VoiceSentinel: race in report buffer cleanup can corrupt transcripts and fill disk

VoiceSentinel, a voice moderation system for Minecraft servers, has a race between retention cleanup and transcript writes in its optional report buffer. Racing writes can lose or corrupt transcript data and stop retention pruning, so disk usage can grow until storage is exhausted.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed VoiceSentinel version and whether it is between `2.2.1` and `3.3.1`
- Check whether `report_buffer.enabled` is set to true in the config
- Check whether `processing.worker_count` is `2` or higher

## Fix

- Move to VoiceSentinel `3.3.1` or later

## Timeline

- 2026-10-30T19:25:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61854

## From the sources

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_