CVE-2026-61854

Name of the Vulnerable Software and Affected Versions VoiceSentinel versions 2.2.1 through 3.3.0

Description A race condition exists in the optional report buffer feature between retention cleanup and normal transcript writes. In report buffer.py, the maybe cleanup() function uses an unlocked dictionary for cleanup throttling, which can lead to simultaneous cleanup tenant() operations for a single tenant. The cleanup process reads and rewrites transcripts.jsonl without file locking or atomic replacement, while report buffer append async appends data without synchronization. In main.py, concurrent processing worker tasks make this reachable, especially when processing.worker count is two or more and public-pool servers share a server key. When report buffer.enabled is set to true, these racing writes can cause loss, duplication, or corruption of transcript data and bypass report buffer.retention seconds pruning. This can result in unbounded disk growth, potentially exhausting storage and crashing the host or other shared services.

Recommendations Update to version 3.3.1. As a temporary workaround, set report buffer.enabled to false to disable the affected feature.