#512 [ENGINE/Race] Tenant config cache snapshot TOCTOU race

closed high Created 2025-12-17 14:58 · Updated 2025-12-17 15:52

Description

Edit
**File:** engine/config.py:640-661 **Problem:** TOCTOU between cache snapshot and cleanup - another thread could add/remove keys between snapshot creation and deletion, causing KeyError. **Severity:** HIGH **Fix:** Ensure entire operation happens under lock: ```python with _config_lock: cache_items = list(_tenant_config_instances.items()) oldest_entries = heapq.nsmallest(to_remove, cache_items, key=lambda x: x[1][1]) for key, _ in oldest_entries: if key in _tenant_config_instances: del _tenant_config_instances[key] ``` **Impact:** KeyError crashes during cache eviction.

Comments

Loading comments...

Context

Loading context...

Audit History

View All
Loading audit history...