mod_wsgi -- race condition at process start can leak request context between requests

2026-10-16 · VuXML entry

Graham Dumpleton reports: A race condition at process startup could let two threads be handed the same per-thread record, because records were allocated from an Apache memory pool shared by every thread without a lock. Threads sharing a record also shared the mod_wsgi.thread_id value and, for named application groups, the same Python thread state, so one request's context (such as session data) could leak into …

Affected versions

• ap24-py312-mod_wsgi < 6.1.1

By system

0 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.