---
id: CVE-2026-61854
title: >-
  VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript
  data and cause unbounded disk growth
summary: >-
  VoiceSentinel is a real-time voice moderation system for Minecraft servers.
  From 2.2.1 until 3.3.1, the optional report buffer feature has a race between
  retention cleanup and normal transcript writes. In `report_buffer.py`,
  `_maybe_clea…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-362
  - CWE-400
  - CWE-667
vendor: jackh54
product: VoiceSentinel
affected:
  - 'VoiceSentinel >= 2.2.1, < 3.3.1'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T18:25:28.484Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-61854'
references:
  - url: >-
      https://github.com/jackh54/VoiceSentinel/security/advisories/GHSA-vhqx-3242-77j7
    label: >-
      https://github.com/jackh54/VoiceSentinel/security/advisories/GHSA-vhqx-3242-77j7
  - url: >-
      https://github.com/jackh54/VoiceSentinel/commit/a8c9f926d19969a19d05eee2a508719aea7f109c
    label: >-
      https://github.com/jackh54/VoiceSentinel/commit/a8c9f926d19969a19d05eee2a508719aea7f109c
  - url: 'https://github.com/jackh54/VoiceSentinel/releases/tag/v3.3.1'
    label: 'https://github.com/jackh54/VoiceSentinel/releases/tag/v3.3.1'
tags:
  - cve.org
epss: 0.00243
epssPercentile: 0.15594
ingestedAt: '2026-11-05T16:24:31.321Z'
---

## Overview

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.

## Affected

- `VoiceSentinel >= 2.2.1, < 3.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.