- severity: High
- files:
shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-tars/src/main/java/org/apache/shenyu/plugin/tars/cache/ApplicationConfigCache.java:327-341
- description:
refreshTarsInvokePrxList calls tarsInvokePrxList.getTarsInvokePrxList().clear() followed later by .addAll(...). The backing list is CopyOnWriteArrayList, so each call is individually atomic but the combined clear-then-addAll is NOT: between the two calls, concurrent request threads in TarsPlugin (line 82) observe size()==0 and throw. method/paramTypes/paramNames are plain non-volatile fields mutated without synchronization.
- impact: During any selector upstream refresh, in-flight tars requests can fail with
IllegalArgumentException/NullPointerException.
- suggested_fix: Build the new list locally then replace atomically (swap a whole new
TarsInvokePrxList into the cache; make fields volatile).
- confidence: High
- related_existing: none
Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.
shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-rpc/shenyu-plugin-tars/src/main/java/org/apache/shenyu/plugin/tars/cache/ApplicationConfigCache.java:327-341refreshTarsInvokePrxListcallstarsInvokePrxList.getTarsInvokePrxList().clear()followed later by.addAll(...). The backing list isCopyOnWriteArrayList, so each call is individually atomic but the combined clear-then-addAll is NOT: between the two calls, concurrent request threads inTarsPlugin(line 82) observesize()==0and throw.method/paramTypes/paramNamesare plain non-volatile fields mutated without synchronization.IllegalArgumentException/NullPointerException.TarsInvokePrxListinto the cache; make fields volatile).Identified during the 2026-08-02 deep re-scan; full list in
docs/scan2-2026-08-02/00-consolidated-critical-high.md.