Weakness (CWE)
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
How to prevent it (8 mitigations)
-
Architecture and Design
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
-
Architecture and Design
Use thread-safe capabilities such as the data access abstraction in Spring.
-
Architecture and Design
Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
-
Implementation
When using multithreading and operating on shared variables, only use thread-safe functions.
-
Implementation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
-
Implementation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
-
Implementation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
-
Implementation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Source: MITRE CWE-362
1,598 results · Feed
-
Low 3.1
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned …
-
High 8.1
Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2…
-
Medium 6.3
Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device
The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authentic…
-
High 7.1
Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outsi…
-
Medium 5.3
AEAD nonce reuse in Zephyr secure_storage ITS default nonce provider due to missing thread synchronization
The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in subsys/secure_storage/src/its/transform/aead_get.c, stores its nonce counter in unsynchronized function-local static variab…
-
High 8.1CVE-2026-61628 Public exploit
nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-t…
-
Medium 5.3
Free5GC Gmm handler.go race condition
A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzer_deps/free5gc/NFs/amf/internal/gmm/handler.go of the component Gmm Handler. This manipulation causes race condition. The attack can be initia…
-
Medium 6.5
Paymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)
Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::doUpgrade() relies on Service::upgradable to check for a pending service upgrade and later executes $credit->increment(…
-
Medium 5.3
Security Advisory 0169
On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked b…
-
Medium 4.2
Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements…
-
High 7.0
In google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds write due to a race condition. This coul…
-
High 7.0
In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race condition. This could lead to local escalat…
-
High 7.0
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation …
-
Medium 6.7
In multiple locations, there is a possible time-of-check to time-of-use due to a race condition. This could lead to loc…
-
High 7.0
In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds write due to a race condition. This could …
-
Medium 6.4
In multiple functions of bluetooth_cco.cc, there is a possible use-after-free due to a race condition. This could lead …
-
Medium 6.4
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation …
-
Medium 6.4
In handle_unmap_req of tipc_virtio_dev.c, there is a possible memory corruption due to a race condition. This could lea…
-
Medium 6.4
In bigo_worker_thread of bigo.c, there is a possible escalation of privilege due to a race condition. This could lead t…
-
High 8.8
In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote code execu…
-
High 7.5
FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC
FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data…
-
Critical 9.1
Sandbox escape due to race condition in the XPConnect component
Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
-
High 7.5
Race condition in the DOM: Content Processes component
Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
-
Medium 4.7
A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, …
-
Medium 5.9
A race condition was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may …
-
Medium 6.3
A race condition was addressed with improved state handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS…
-
Medium 4.7
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 an…
-
High 7.8
A race condition was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 …
-
High 7.8CVE-2026-43783 Public exploit
A race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be a…
-
Medium 4.7
A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.6. An app may be able …
-
Medium 4.7
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 an…
-
High 8.1
A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Ga…
-
Medium 4.7
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 an…
-
Medium 5.5
A race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 2…
-
Medium 4.7
A race condition was addressed with improved state handling. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden …
-
High 7.8
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 an…
-
Medium 4.7
A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 1…
-
Medium 5.3
Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronizati…
-
Medium 4.2
IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process.
-
High 7.8
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.