- severity: High
- files:
shenyu-plugin/shenyu-plugin-logging/shenyu-plugin-logging-common/src/main/java/org/apache/shenyu/plugin/logging/common/collector/AbstractLogCollector.java:139-144
- description:
initQueue() is called from collect() via bufferQueueS.computeIfAbsent(...). Inside, instance fields bufferSize and bufferQueue are reassigned as side effects. Neither field is volatile. Multiple request threads calling collect() concurrently with different selectorIds race on these reassignments; non-volatile bufferSize may be stale when read at line 94 (bufferQueue.size() < bufferSize).
- impact: Race on
bufferSize/bufferQueue can cause incorrect capacity checks → premature log drops or IllegalStateException.
- suggested_fix: Make
initQueue return a holder (queue + capacity) instead of mutating shared instance fields.
- confidence: High
- related_existing: none
Identified during the 2026-08-02 deep re-scan; full list in docs/scan2-2026-08-02/00-consolidated-critical-high.md.
shenyu-plugin/shenyu-plugin-logging/shenyu-plugin-logging-common/src/main/java/org/apache/shenyu/plugin/logging/common/collector/AbstractLogCollector.java:139-144initQueue()is called fromcollect()viabufferQueueS.computeIfAbsent(...). Inside, instance fieldsbufferSizeandbufferQueueare reassigned as side effects. Neither field isvolatile. Multiple request threads callingcollect()concurrently with differentselectorIds race on these reassignments; non-volatilebufferSizemay be stale when read at line 94 (bufferQueue.size() < bufferSize).bufferSize/bufferQueuecan cause incorrect capacity checks → premature log drops orIllegalStateException.initQueuereturn a holder (queue + capacity) instead of mutating shared instance fields.Identified during the 2026-08-02 deep re-scan; full list in
docs/scan2-2026-08-02/00-consolidated-critical-high.md.