Weakness (CWE)
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
How to prevent it (8 mitigations)
-
Architecture and Design
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
-
Architecture and Design
Use thread-safe capabilities such as the data access abstraction in Spring.
-
Architecture and Design
Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
-
Implementation
When using multithreading and operating on shared variables, only use thread-safe functions.
-
Implementation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
-
Implementation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
-
Implementation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
-
Implementation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Source: MITRE CWE-362
1,544 results · Feed
-
Medium 5.3
olivier-ls PHP-FTS Storage.php open toctou
A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 …
-
Low 3.7
GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition
The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneo…
-
High 7.7CVE-2026-111770 Public exploit
Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another
The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Se…
-
High 7.5
Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials path
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard au…
-
Low 3.7
YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending via Race Condition
The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple…
-
Medium 5.9
FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then c…
-
Medium 5.9
FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to …
-
High 7.5
FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race
FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending …
-
High 8.3
Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitr…
-
High 8.8
Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside…
-
Medium 4.2
Authenticated Race Condition in API of HPE Networking Fabric Composer
A race condition vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to corrupt the configuration state of the affected system.
-
Low 3.7
Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint,…
-
Medium 5.3
FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel
FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_lock. A malicious RDP ser…
-
Medium 6.7
The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::we…
-
Low 2.5
A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` wh…
-
High 7.4
In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalati…
-
High 7.4
In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. …
-
High 7.4
In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to…
-
Medium 5.9
In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. Th…
-
High 8.1
In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote …
-
Medium 5.9
Race condition vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may …
-
High 8.2
VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocke…
-
Medium 5.9
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
## Summary Soft Serve cached repository records in memory with no expiry, and trusted the cached record for every access check. `SetPrivate` cleared the cached record before it saved the new visibility, and not afterwards. A request that arrived between the t…
-
Medium 4.2
Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separat…
-
High 8.1
In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not c…
-
Medium 5.7
OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) v…
-
High 8.8
Race condition in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arb…
-
High 8.8
Race condition in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary…
-
Medium 6.5
a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition
A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The atta…
-
Medium 5.4
a2aproject a2a-java TaskManager.saveTaskEvent race condition
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix…
-
High 8.8
Race condition, use-after-free in the DOM: File component
Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
-
High 8.8
Race condition in the IPC component
Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
High 8.8
Race condition in the Disability Access APIs component
Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
-
Low 3.7
@fastify/session vulnerable to session revocation bypass via a logout race condition
@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call,…
-
Medium 5.3
A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8…
-
Medium 4.7
A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Golden Gate 27.2,…
-
High 7.0
A race condition was addressed with improved locking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and…
-
Medium 4.7
A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Golden Gate 27.2,…
-
High 7.8
A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia…
-
High 7.0
A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia…