Weakness (CWE)
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
How to prevent it (7 mitigations)
-
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
-
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
-
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
-
Implementation, Architecture and Design
If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
-
Implementation
Recheck the resource after the use call to verify that the action was taken appropriately.
-
Architecture and Design
Ensure that some environmental locking mechanism can be used to protect resources effectively.
-
Implementation
Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.
Source: MITRE CWE-367
827 results · Feed
-
Medium 5.9
In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload…
-
Low 3.3
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock and AsyncReadWriteLock on Windows use _connect to attach SQLite to the lock database by pathname, allowing another local account that can create adjacent names to …
-
Low 3.1
LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding
LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return …
-
Medium 5.8
Privileged file deletion in SafeNet Authentication Client SACSrv
A time-of-check to time-of-use race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function can allow an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log directory. …
-
High 7.2
Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
Cocos AI is a confidential computing system for AI. Prior to 0.9.0, Cocos AI performs attestation only once when an attested TLS connection is established. An attacker who can modify the attester's workload code, memory-backed state, configuration, or attache…
-
Low 2.3
Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)
The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding to bypass private network restrictions, resulting in enumeration of internal hosts and ports in Symfony versions prior …
-
Critical 9.1
Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass
Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attest…
-
High 7.7CVE-2026-109518 Public exploit
APT RCE via hard link reuse
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…
-
Medium 6.0
Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record fo…
-
High 7.0
Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode
The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in drivers/i3c/i3c_handlers.c, validated the caller-supplied struct i3c_device_desc in place instead of snapshotting it. It confirmed only that the descriptor was rea…
-
High 8.8
Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web orig…
-
Medium 5.3
Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sens…
-
High 8.8
Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside…
-
High 7.7
Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace
Claude Code is an agentic coding tool. Prior to 2.1.251, the Edit tool validates a target using pathname and symlink resolution that is not bound to the underlying directory inode or file descriptor. On macOS, attacker-controlled code running in the Bash sand…
-
High 8.1
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the s…
KEV Nov 3, 2026 -
Medium 6.5
pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check
In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it with a plain open() or handed the path to a utility that opened it later: the serv…
-
Medium 6.5
pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked
In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path with get_abs_path(). Several callers then acted on a path they built differently, so the path checked and the path used …
-
Medium 5.9
charmbracelet/soft-serve: Race in `SetPrivate` leaves a private repository readable by unauthenticated users
## Summary Soft Serve cached repository records in memory with no expiry, and trusted the cached record for every access check. `SetPrivate` cleared the cached record before it saved the new visibility, and not afterwards. A request that arrived between the t…
-
Medium 6.8
epiphany: TLS certificate warning bypass via race in tlsErrorPage message handler
A race condition in Epiphany allows a malicious website to bypass the TLS/SSL certificate warning page. Epiphany registers the main-world script message handler "tlsErrorPage" so its internal TLS error page can implement "Accept Risk and Proceed". The handler…
-
Medium 4.8
Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to …
-
High 7.8
Privilege Escalation via Insecure Package Handling in TeamViewer Full Client and Host for macOS
A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Full Client and Host prior to version 15.83 for macOS allows a local attacker with low privileges to bypass installer pack…
-
Medium 4.3
Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurre…
-
Medium 6.5
A memory integrity issue was addressed with improved handling of copy-on-write pages. This issue is fixed in iOS 26.7.2…
-
High 8.8
TOCTOU Race Condition in boneIO
boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py. The function writes sudoers rules to a predictable temporary file, validates them, then installs them with root privile…
-
Medium 5.4
OpenReception: race condition in add-to-tunnel and create-new-client allows overlapping appointments for one agent
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclu…
-
Medium 6.5CVE-2026-105481 Public exploit
A flaw in Node.js HTTP Agent connection reuse can cause a client to accept as valid a response that was sent before the…
-
High 7.2
PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback…
-
Medium 6.5
Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineer…
-
High 8.8
Race condition in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the …
-
High 8.8
Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compr…
-
High 8.8
Race condition in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromi…
-
High 8.8
Race condition in OptimizationGuide in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to leak sensitive…
-
High 8.8
Race condition in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the re…
-
High 8.8
Race condition in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering…
-
Medium 6.5
Race condition in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a local attacker to execute arbit…
-
High 8.8
Race condition in Toolbar in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging so…
-
High 8.8
Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engine…
-
High 8.8
Race condition in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised th…
-
High 8.8
Race condition in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compr…
-
High 8.8
Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engine…