Weakness (CWE)
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
How to prevent it (7 mitigations)
-
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
-
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
-
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
-
Implementation, Architecture and Design
If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
-
Implementation
Recheck the resource after the use call to verify that the action was taken appropriately.
-
Architecture and Design
Ensure that some environmental locking mechanism can be used to protect resources effectively.
-
Implementation
Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.
Source: MITRE CWE-367
317 results · Clear filters · Feed
-
Medium 5.3
Race condition in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the …
-
Medium 4.3
Race condition in Permissions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveragin…
-
Medium 4.3
Race condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the ren…
-
Medium 6.8
PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later resolve to 127.0.0.1, 16…
-
Medium 5.3
Grav API Plugin before 1.0.16 SSRF via DNS Rebinding
Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer v…
-
Medium 6.4
TOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memory
The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg *…
-
Medium 6.3
Non-atomic hash-credential dedup in mpp Tempo allows replay of a confirmed payment under a concurrent race
Time-of-check Time-of-use (TOCTOU) Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple paid-resource accesses. The type="hash" credential path in MPP.Methods.Tempo.verify/2 guards against…
-
Medium 6.3
Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for CVE-2026-55162)
Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificates/verify.py checked the original CRL or OCSP URL but the later request could reach a different destination. The CRL requests.get call followed HTTP redirects …
-
Medium 5.9
rsync < 3.5.0 Symlink Race Condition Directory Traversal
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manip…
-
Medium 4.7
rsync < 3.5.0 Symlink Race Condition via --remove-source-files
rsync before 3.5.0 contains a symlink race condition vulnerability in the --remove-source-files feature that allows attackers with symlink creation access to cause arbitrary file deletion. Attackers can atomically substitute a symlink for a source file betwee…
-
Medium 6.3
rsync < 3.5.0 Symlink Race Condition via ACL/xattr Application
rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write…
-
Medium 4.7
rsync < 3.5.0 Symlink Race Condition Information Disclosure
rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's source tree traversal that allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths. Attackers can atomically repl…
-
Medium 6.3
rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes …
-
Medium 5.8
Time-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device…
-
Medium 5.1
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to pri…
-
Medium 5.7
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to pri…
-
Medium 4.4
Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation
A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp …
-
Medium 6.3
Electron: Parent process code-sign check is spoofable
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, the check Electron uses on macOS to confirm it was launched by a same-signed parent process could be by…
-
Medium 5.3
mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access
Mealie's AsyncSafeTransport SSRF guard (mealie/pkgs/safehttp/transport.py) resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying …
-
Medium 6.3
Open WebUI: DNS Rebinding SSRF Bypass
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname ag…
-
Medium 6.5
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager sin…
-
Medium 5.3CVE-2026-58041 Public exploit
A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to con…
-
Medium 5.6
Caliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)
Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that…
-
Medium 6.5
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
-
Medium 4.4
Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape
A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where th…
-
Medium 5.5
In Audio HAL, there is a possible system becoming unresponsive due to a race condition. This could lead to local denial…
-
Medium 6.0
In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of…
-
Medium 5.9
LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup
LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the worker_thread_cleanup() function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchro…
-
Medium 5.8
Linuxfabrik monitoring-plugins: Symlink following in logfile legacy database migration
Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In version 6.0.0, the logfile check legacy database migration moved a predictable path from /tmp with os.rename() and allowed a local user co…
-
Medium 6.5
Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to merge code into a protected branch without the req…
-
Medium 4.7
ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219
An incomplete fix of CVE-2026-49219 could result in a policy bypass.
-
Medium 5.8
Local File Deletion Attack Vector in rm_rf() in seunshare
A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils…
-
Medium 5.3
Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou
A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carr…
-
Medium 4.9
Statamic: Server-Side Request Forgery via Glide (DNS rebinding)
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.24 and 6.20.1, the Glide image proxy's URL validation in src/Imaging/RemoteUrlValidator.php and src/Imaging/GuzzleAdapter.php could be bypassed using DNS rebinding. The remot…
-
Medium 5.8
TOCTOU double copyin in illumos dld ioctl handling causes kernel heap corruption
A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c copies the dld_ioc_macpr…
-
Medium 6.4
TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety
TOCTOU Race Condition in specific trace commands of the TraceEvent() system call could allow an attacker with local access and with the PROCMGR_AID_TRACE ability, to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.
-
Medium 6.3CVE-2026-57973 Public exploit
Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability
Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to perform tampering locally.
-
Medium 5.5
Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability
Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
-
Medium 5.5
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract() uses a predictable home-rooted output directory (~/ubuntu_data/ubuntu_dialogs) with a check-then-create pattern followed by t…
-
Medium 6.5
CoreWCF NetNamedPipe transport accepts attach to a pre-existing named pipe instance
CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF NetNamedPipe transport accepts attachment to a pre-existing named pipe instance, allowing local interception of NetNamedPipe traffi…