apache / apache/shenyu

[BUG] SubscribeRepository.add lost-update race loses subscribers

Open
#6,746 2 comments 0 reactions 1 assignee Claimed by @wy471x View on GitHub
plugin: mqtt priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

- severity: Medium
- files: `shenyu-protocol/shenyu-protocol-mqtt/src/main/java/org/apache/shenyu/protocol/mqtt/repositories/SubscribeRepository.java:43-48,56-62,90-92`
- description: `add(Channel, List)` runs in `CompletableFuture.runAsync` + `parallelStream`, calls `get(topic)` which returns a fresh `new CopyOnWriteArrayList<>()` via `getOrDefault` for an absent topic (a transient list not inserted into the map), `channels.add(channel)`, then `put`. Two concurrent subscribers to a new topic each get an empty list, add themselves, and `put` — last write wins, first subscriber silently dropped.
- impact: Subscribers silently lost under concurrent subscription to the same topic; messages not delivered to all.
- suggested_fix: Use `computeIfAbsent` to obtain the canonical list and atomically add.
- confidence: High
- related_existing: none

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.