VoiceSentinel: Race condition in report buffer cleanup corrupts transcript data
Summary
VoiceSentinel, a real-time voice moderation system for Minecraft servers, contains a race condition in its optional report buffer. Concurrent retention cleanup and transcript writes can lose, duplicate or corrupt stored transcripts and prevent retention pruning, so the transcript file grows without bound. An attacker can trigger this only indirectly through normal concurrent operation, and it can exhaust disk storage and crash the host or other services on it. The feature is disabled by default and the issue is fixed in version 3.3.1.
Affected
- VoiceSentinel from 2.2.1 up to, but not including, 3.3.1 (CNA data)
- Only installations with report_buffer.enabled set to true
- Higher risk with processing.worker_count of 2 or more and public-pool servers sharing a server_key
- Note: VulDB lists a lower bound of 3.0; the lower bound is unconfirmed.
Fixed in
- Version 3.3.1
Workaround
- Set report_buffer.enabled to false (the feature is disabled by default)
- Unverified: reduce processing.worker_count to 1 to reduce collisions; not tested by the vendor
Exploitation
- Not known to be exploited in the wild
- No CISA KEV listing found
- Public proof-of-concept: unverified; VulDB reports no exploit available
Our recommendation
- Check whether VoiceSentinel is in use and whether report_buffer.enabled is true
- If the feature is not needed, keep it disabled
- Upgrade to version 3.3.1 or later
- Monitor disk usage of the report buffer directory and the host, especially on shared VPS hosts
- Priority: low if the feature is off, medium if enabled, high if on a shared host with multiple workers
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-vhqx-3242-77j7 github.com
- Fix commit a8c9f926d19969a19d05eee2a508719aea7f109c github.com
- VoiceSentinel release v3.3.1 github.com
- VulDB entry 429286 vuldb.com
- OffSeq Radar entry CVE-2026-61854 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:31.
Original description (NVD)
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.