https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T16:44:14.298519+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-321959 EUVD-2026-321959 2026-10-08T16:44:14.300585+00:00 EUVD-2026-321959 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43981 fkie_cve-2026-43981 2026-10-08T16:44:14.300619+00:00

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since gopher-lua's LState is explicitly not goroutine-safe, concurrent requests race on the shared state causing Lua VM corruption. The Go race detector confirms this immediately under modest concurrency (ab -n 1000 -c 100). This vulnerability is fixed in 1.17.6.