Skip to content
OpenAdvisories

Weakness (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization

Class Draft

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

How to prevent it (8 mitigations)

  1. Architecture and Design

    In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.

  2. Architecture and Design

    Use thread-safe capabilities such as the data access abstraction in Spring.

  3. Architecture and Design

    Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.

    Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).

  4. Implementation

    When using multithreading and operating on shared variables, only use thread-safe functions.

  5. Implementation

    Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.

  6. Implementation

    Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.

  7. Implementation

    Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.

  8. Implementation

    Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.

Source: MITRE CWE-362

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-85248 Public exploit

    Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. The producer held a single java.sec…

    Apache Software Foundation Apache Camel
  • Medium 4.7
    CVE-2026-28992 Public exploit

    A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 18.7.9 and iPadOS 18.…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Medium 4.7
    CVE-2025-5054 Public exploit

    Race Condition in Canonical Apport

    Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing proc…

    Canonical Apport apport Ubuntu
  • Medium 5.9
    CVE-2024-53476 Public exploit

    A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to …

  • Medium 6.4
    CVE-2024-28999 Public exploit EPSS 14%

    SolarWinds Platform Race Condition Vulnerability

    The SolarWinds Platform was determined to be affected by a Race Condition Vulnerability affecting the web console.

    SolarWinds SolarWinds Platform
  • Medium 5.7
    CVE-2024-2193 Public exploit

    Speculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.

    A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the …

    AMD Xen Xen CPU Virtualization Debian Ubuntu Alpine
  • Medium 5.9
    CVE-2018-15473 Public exploit EPSS 99%

    OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticat…

    openssh openssh openssh Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2014-0196 Exploited Public exploit EPSS 20%

    The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver …

    linux linux Debian Ubuntu
    KEV May 12, 2023