Weakness (CWE)
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
How to prevent it (7 mitigations)
-
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
-
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
-
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
-
Implementation, Architecture and Design
If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
-
Implementation
Recheck the resource after the use call to verify that the action was taken appropriately.
-
Architecture and Design
Ensure that some environmental locking mechanism can be used to protect resources effectively.
-
Implementation
Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.
Source: MITRE CWE-367
35 results · Clear filters · Feed
-
Critical 9.1
Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass
Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attest…
-
Critical 9.6
Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the…
-
Critical 9.1
Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in team-alembic AshAuthentication allows an attacker holding a leaked magic link to replay its single-use token and authenticate as the target subject. A magic link configured with single_use_tok…
-
Critical 9.0
safeurl validated address is not bound to the request, allowing DNS rebinding
Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the …
-
Critical 9.9
A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privile…
-
Critical 9.3
TOCTOU Vulnerability in file exchange
A service running on the affected products contains a potential Time-of-Check Time-of-Use (TOCTOU) race condition. An unauthenticated remote attacker could exploit this race condition to bypass intended security controls. This may result in the execution of u…
-
Critical 9.4
Google Cloud Build Comment Control Bypass via Webhook Suppression
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerab…
-
Critical 9.6
Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purcha…
-
Critical 9.9
Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge
An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD perfo…
-
Critical 9.3
net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_h…
-
Critical 9.4
varstored: TOCTOU issues with mapped guest memory
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issu…
-
Critical 9.0
Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag
## Summary Crossplane allows package signature verification to be configured via the `ImageConfig` mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is inst…
-
Critical 9.8
OpenClaw < 2026.5.27 - Node Pairing State Mutation via Reconnection
OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. Attackers can exploit reconnection logic to restore or present broader node authority than intended, p…
-
Critical 9.6
OpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes
OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to …
-
Critical 9.8
AGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU ra…
-
Critical 9.0
A race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 1…
-
Critical 9.3
ClipBucket v5 Affected by Remote Code Execution via Avatar/Background File Upload Race Condition
ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability exists in ClipBucket's avatar and background image upload functionality. The application moves uploaded files to…
-
Critical 10.0
SandboxJS has a sandbox escape via TOCTOU bug on keys in property accesses
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, there is a sandbox escape vulnerability due to a mismatch between the key on which the validation is performed and the key used for accessing properties. Even though the key used in property acces…
-
Critical 9.4
n8n Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
n8n is an open source workflow automation platform. Prior to versions 1.123.18 and 2.5.0, a vulnerability in the file access controls allows authenticated users with permission to create or modify workflows to read sensitive files from the n8n host system. Th…
-
Critical 9.9
Double fetch in sandbox kernel driver in Avast/AVG Antivirus <25.3 on windows allows local attacker to escalate privel…
-
Critical 10.0
Manager-io/Manager: Complete Bypass of SSRF Protection via Time-of-Check Time-of-Use (TOCTOU)
Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access to internal network resources. The flaw lies in the fundamental design of the DNS validation mechani…
-
Critical 10.0CVE-2025-34027 EPSS 46%
Versa Concerto Authentication Bypass File Write Remote Code Execution
The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for a Time-of-Check to T…
-
Critical 9.3CVE-2025-22224 Exploited
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds …
KEV Mar 4, 2025 -
Critical 9.8
IBM Engineering Requirements Management DOORS Next code execution
IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted request, an attacker could exploit this vulnerability to remotely exec…
-
Critical 9.8
Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97. The following versions were EOL at the time the CV…
-
Critical 9.8
Apache Tomcat: RCE due to TOCTOU issue in JSP compilation
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration). This issue affects Apache Tomcat…
-
Critical 9.8
IBM Engineering Systems Design Rhapsody - Model Manager
IBM Engineering Systems Design Rhapsody - Model Manager 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted request, an attacker could exploit this vulnerability to remotely…
-
Critical 9.1
Waitress has request processing race condition in HTTP pipelining with invalid first request
Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we…
-
Critical 9.0
NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases wh…
-
Critical 9.0
Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability
Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to execute privileged code o…
-
Critical 9.8
OpenStack magnum vulnerable to time-of-check to time-of-use (TOCTOU) attack
An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py. component.
-
Critical 9.4CVE-2022-36980 EPSS 82%
This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2…
-
Critical 9.3
Time-of-check time-of-use race condition in Core
Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.
-
Critical 9.8
RPC call failure in ckb
An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction.
-
Critical 9.8CVE-2021-32708 Public exploit
Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem
Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The condition…