CVE-2026-68511: Paaster: TOCTOU race condition defeats the 'burn after reading' guarantee on view-once pastes
Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as "not yet read" and all successfully retrieve it. This issue has been patched in version 3.3.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Paasterto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Which deployments are affected?
Paaster deployments using versions prior to 3.3.0 are affected when they offer the view-once, burn-after-reading paste mode.
What does an attacker need to exploit this issue?
An attacker needs to send multiple requests for the same view-once paste concurrently. The race allows multiple requests to observe the paste as unread and retrieve its contents.
Are ordinary pastes affected?
The issue concerns the view-once paste mode and its single-use enforcement. The provided information does not identify other paste modes as affected.
What should be done to remediate the issue?
Upgrade Paaster to version 3.3.0, which includes the patch.