A race condition vulnerability in the Go standard library database/sql package may lead to data corruption or incorrect query results during parallel database operations.

This flaw is a race condition (CWE-362) occurring when a query is cancelled via context during a Scan operation. It allows for potential data leakage or integrity failure when multiple queries are executed in parallel, and it does not require user authentication to trigger if the application exposes vulnerable query logic.

The primary impact of this vulnerability is the potential for silent data corruption or the return of incorrect information to the end user. Because the flaw affects database operations, it poses a risk to data integrity and system reliability. With a CVSS score of 7.0, this issue is classified as High severity, necessitating prompt attention to ensure the accuracy of application data.

Immediate Action: Update the Go environment to version 1.23.12 or 1.24.6, which contain the necessary synchronization fixes for the database/sql package.

Proactive Monitoring: Monitor application logs for unexpected database errors or inconsistent data patterns occurring during high-concurrency periods.

Compensating Controls: If immediate patching is not feasible, review application code to ensure that context cancellation and Scan operations are serialized or properly isolated to prevent concurrent interference.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the central role of the database/sql package in Go applications, this vulnerability presents a significant risk to data consistency. Organizations should prioritize updating their Go toolchain to the specified patched versions to eliminate this race condition. Failure to apply these updates may leave applications susceptible to intermittent and difficult-to-debug data integrity issues.