Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61854— VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth

Quick assessment

Affected
jackh54 VoiceSentinel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

VoiceSentinel 是一个专为 Minecraft 服务器设计的实时语音内容审核系统。在 2.2.1 至 3.3.1 版本中，其可选的报告缓冲区（report buffer）功能存在保留清理与常规转录写入之间的竞态条件。在 文件中， 方法使用未加锁的字典来实现每小时一次的清理限流，导致同一租户的多个 操作可能同时执行。清理过程会读取 文件并原地重写，既未使用文件锁，也未采用原子替换机制；而 则通过 异步追加数据，且缺乏同步保护。在 中，并发的 任务使得该问题在正常运行中即可被触发；当 设置为两个或更多，且多

CVSS 8.2 · High

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Affected Version Matrix 1

VendorProduct Version RangeStatus
jackh54 VoiceSentinel >= 2.2.1, < 3.3.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61854

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth
Source: CVE Program / CVE List V5
Vulnerability Description
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
jackh54 VoiceSentinel >= 2.2.1, < 3.3.1 -

II. Public POCs for CVE-2026-61854

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61854

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-61854 (1)

Vendor Advisories for CVE-2026-61854 (1)

Vendor Pages for CVE-2026-61854 (1)

IV. Related Vulnerabilities

Same weakness: CWE-362