Security advisory2026-10-08Software component projectSecurity advisory

Software component issue could cause actions to run with inconsistent state

A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1.

What happened

A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable and when the service constructs and returns the response context. As a result, the first request adopts the modified context, causing the service to return sensitive management details or configuration data belonging to the second context back to the original requester.Security Advisory CVE-2026-94583
A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable and when the service…Advisory description (CVE-2026-94583)

Contributing factors stated by the source

A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before 10.0.1. When handling concurrent incoming network management FCIP requests, a timing window exists between when a request populates the address variable and when the service…

The failure pattern

Duplicate action after an ambiguous resultA request times out, the caller assumes it failed and retries, and the money moves (or the order ships) twice.How to prevent it Automation acts on stale state or authorizationA background job or automation acts on a plan, permission or record that changed after it was read.How to prevent it

Watch the pattern: Duplicate action after an ambiguous result

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Documented incidentPublished 2017-02-22

Design reference: idempotency keys make retried payment API calls safe (Stripe)

Stripe explains that a client which cannot tell whether a request succeeded (for example after a network failure) needs to retry safely, and that without protection a retried charge could double-charge a customer.

Duplicate action after an ambiguous resultstripe.com

Security advisory2026-10-13