Skip to content
OpenAdvisories

Weakness (CWE)

CWE-366: Race Condition within a Thread

Base Draft

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Use locking functionality. This is the recommended solution. Implement some form of locking mechanism around code which alters or reads persistent data in a multithreaded environment.

  2. Architecture and Design

    Create resource-locking validation checks. If no inherent locking mechanisms exist, use flags and signals to enforce your own blocking scheme when resources are being used by other threads of execution.

Source: MITRE CWE-366

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.2
    CVE-2026-3904

    Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library …

    The GNU C Library glibc glibc Debian
  • Medium 5.9
    CVE-2026-23684

    Race condition vulnerability in SAP Commerce Cloud

    A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data i…

    SAP_SE SAP Commerce Cloud
  • Medium 5.9
    CVE-2026-22819

    Outray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts

    Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This…

    akinloluwami outray outray npm
  • Medium 4.7
    CVE-2023-4732

    Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.h

    A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  • Medium 6.5
    CVE-2023-4127

    Race Condition within a Thread in answerdev/answer

    Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1.

    answerdev answerdev/answer github.com/answerdev/answer Go
  • Medium 6.5
    CVE-2023-3218

    Race Condition within a Thread in it-novum/openitcockpit

    Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.

    it-novum it-novum/openitcockpit
  • Medium 4.6
    CVE-2015-10067

    oznetmaster SSharpSmartThreadPool SmartThreadPool.cs race condition

    A vulnerability was found in oznetmaster SSharpSmartThreadPool. It has been classified as problematic. This affects an unknown part of the file SSharpSmartThreadPool/SmartThreadPool.cs. The manipulation leads to race condition within a thread. The complexity …

    oznetmaster SSharpSmartThreadPool
  • Medium 5.9
    CVE-2021-38191

    Race condition in tokio

    An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread.

    tokio crates.io
  • Medium 5.9
    CVE-2020-1629

    Junos OS: A race condition vulnerability may cause RPD daemon to crash when processing a BGP NOTIFICATION message.

    A race condition vulnerability on Juniper Network Junos OS devices may cause the routing protocol daemon (RPD) process to crash and restart while processing a BGP NOTIFICATION message. This issue affects Juniper Networks Junos OS: 16.1 versions prior to 16.1R…

    Juniper Networks Junos OS Network devices