A paste created with burn_after_read: true, burn_after_reads: 1 can be read more than once when requests arrive concurrently — the burn counter is decremented non-atomically.
Repro: create 1-read burn paste, then fire ~15-20 parallel GETs to /raw/{id}:
Run 1: 3x HTTP 200, 17x 404
Run 2: 2x HTTP 200, 13x 404
Expected: exactly one 200. Impact: content intended to self-destruct after one read is delivered to multiple readers. Likely a read-then-decrement race (TOCTOU) in the burn handler.
Verified on dev build 2026-09-09, blind black-box test.
**Severity: High**
A paste created with `burn_after_read: true, burn_after_reads: 1` can be read more than once when requests arrive concurrently — the burn counter is decremented non-atomically.
Repro: create 1-read burn paste, then fire ~15-20 parallel GETs to /raw/{id}:
- Run 1: 3x HTTP 200, 17x 404
- Run 2: 2x HTTP 200, 13x 404
Expected: exactly one 200. Impact: content intended to self-destruct after one read is delivered to multiple readers. Likely a read-then-decrement race (TOCTOU) in the burn handler.
Verified on dev build 2026-09-09, blind black-box test.
Duplicate of #58 (burn-after-read race, found in the #34 sweep and already assigned to a fix branch). Keeping #58 as the tracking issue. The pentest repro confirms the MED finding from #34.
Duplicate of #58 (burn-after-read race, found in the #34 sweep and already assigned to a fix branch). Keeping #58 as the tracking issue. The pentest repro confirms the MED finding from #34.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: High
A paste created with
burn_after_read: true, burn_after_reads: 1can be read more than once when requests arrive concurrently — the burn counter is decremented non-atomically.Repro: create 1-read burn paste, then fire ~15-20 parallel GETs to /raw/{id}:
Expected: exactly one 200. Impact: content intended to self-destruct after one read is delivered to multiple readers. Likely a read-then-decrement race (TOCTOU) in the burn handler.
Verified on dev build 2026-09-09, blind black-box test.
Duplicate of #58 (burn-after-read race, found in the #34 sweep and already assigned to a fix branch). Keeping #58 as the tracking issue. The pentest repro confirms the MED finding from #34.