This vulnerability is a race condition in the AssetLastHostname.increment_hostname function of allegro's Hostname Allocation Handler. By manipulating the counter argument, concurrent executions can update the hostname counter unsafely, potentially leading to inconsistent system state. The weakness is classified as CWE-362. Although the reported exploitation is complex and the CVSS score is 2.1, the defect is publicly disclosed and may be usable if an attacker can orchestrate the required concurrency.

Any installation of allegro that uses the AssetLastHostname.increment_hostname method prior to commit bcf65b994ef29fb3fc2e10b660e6288723d5209e (the version identified as vulnerable) is affected. No specific product versions are listed in the advisory.

The CVSS score of 2.1 indicates low severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no publicly available exploits are reported. Exploitation requires generating concurrent requests to the function, making the attack complex. Overall risk remains low but monitoring is advised.