Skip to content
OpenAdvisories

Weakness (CWE)

CWE-412: Unrestricted Externally Accessible Lock

Base Incomplete

The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.

More detail

This prevents the product from acting on associated resources or performing other behaviors that are controlled by the presence of the lock. Relevant locks might include an exclusive lock or mutex, or modifying a shared resource that is treated as a lock. If the lock can be held for an indefinite period of time, then the denial of service could be permanent.

How to prevent it (3 mitigations)

  1. Architecture and Design, Implementation

    Use any access control that is offered by the functionality that is offering the lock.

  2. Architecture and Design, Implementation

    Use unpredictable names or identifiers for the locks. This might not always be possible or feasible.

  3. Architecture and Design

    Consider modifying your code to use non-blocking synchronization methods.

Source: MITRE CWE-412

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Low 1.8
    CVE-2026-82312

    OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial…

    OpenVPN OpenVPN
  • High 8.8
    CVE-2026-62426

    sysctl and platform-op locks open to abuse

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these o…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 6.5
    CVE-2026-25612

    Internal ResourceId collision may affect unrelated collections

    The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what lock to take. Collections may inadvertently collide with one another in this representation causing unavailability between them due to conf…

    MongoDB MongoDB Server mongodb Ubuntu
  • High 7.5
    CVE-2023-38505

    DietPi-Dashboard Insufficient TLS Handshake Pool

    DietPi-Dashboard is a web dashboard for the operating system DietPi. The dashboard only allows for one TLS handshake to be in process at a given moment. Once a TCP connection is established in HTTPS mode, it will assume that it should be waiting for a handsha…

    ravenclaw900 DietPi-Dashboard
  • High 7.5
    CVE-2023-22318

    Denial of service against webconf

    Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5.

    Tribe29 Checkmk Appliance check-mk Ubuntu
  • Low 3.3
    CVE-2019-11485

    apport created lock file in wrong directory

    Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling.

    Canonical Apport apport Ubuntu
  • High 8.6
    CVE-2019-18269

    Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.

    Omron Omron PLC NX1P2 series Omron PLC CS series Omron PLC CJ Series ICS / OT