Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as "not yet read" and all successfully retrieve it. This issue has been patched in version 3.3.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 11 Nov 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as "not yet read" and all successfully retrieve it. This issue has been patched in version 3.3.0. | |
| Title | Paaster: TOCTOU race condition defeats the 'burn after reading' guarantee on view-once pastes | |
| Weaknesses | CWE-362 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-11-11T21:56:59.654Z
Reserved: 2026-07-30T16:19:08.082Z
Link: CVE-2026-68511
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-11T22:17:30.013
Modified: 2026-11-11T22:17:30.013
Link: CVE-2026-68511
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses