AIKIDO-2026-10352

TL;DR

Affected versions of this package contain a race condition in the internal request tracing logic where httptrace callbacks may access a shared statebag concurrently without proper synchronization, leading to a runtime panic. Because the statebag was used to propagate time.Time values across tracing hooks, concurrent access could corrupt state and crash the application. An attacker could exploit this condition by triggering multiple concurrent requests that invoke httptrace callbacks simultaneously, causing repeated panics and resulting in a denial-of-service condition by crashing or destabilizing the service handling those requests.