Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-101356CRITICALApache Tomcat: HTTP/2 request/response mix-up after error during async processingEPSS 0.5%CVE-2026-82543MEDIUMvastsa FileCodeBox Pickup Limit views.py update_file_usage race conditionEPSS 0.5%CVE-2024-22047LOWAudited Log Integrity Errors Due to Race ConditionEPSS 0.5%CVE-2026-100394MEDIUMNezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenantEPSS 0.5%CVE-2025-55231HIGHWindows Storage-based Management Service Remote Code Execution VulnerabilityEPSS 0.5%CVE-2022-0279—AnyComment < 0.2.18 - Comment Rating Increase/Decrease via Race ConditionEPSS 0.5%CVE-2024-27876HIGHA race condition was addressed with improved locking. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 1EPSS 0.5%CVE-2026-63978CRITICALnet/handshake: Drain pending requests at net namespace exitEPSS 0.5%CVE-2025-55191MEDIUMRepository Credentials Race Condition Crashes Argo CD ServerEPSS 0.5%CVE-2026-69830HIGHWindows DHCP Server Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-19506HIGHRDK-B WebUI race condition vulnerabilityEPSS 0.5%CVE-2026-46727HIGHAn issue was discovered in Ruby 4 before 4.0.5. A race condition leading to a use-after-free in the pthread-based getaddrinfo timeout handleEPSS 0.5%CVE-2026-46137CRITICALmptcp: pm: ADD_ADDR rtx: fix potential data-raceEPSS 0.5%CVE-2022-36422MEDIUMWP-PostRatings plugin <= 1.89 - Rating increase/decrease via race conditionEPSS 0.5%CVE-2021-23133MEDIUMLinux Kernel sctp_destroy_sock race conditionEPSS 0.5%CVE-2026-42913HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.5%CVE-2021-46873MEDIUMWireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's EPSS 0.5%CVE-2026-31676HIGHrxrpc: only handle RESPONSE during service challengeEPSS 0.5%CVE-2026-50013HIGHHoverfly: Process Crash via Concurrent Map Write Race Condition in Diff ModeEPSS 0.5%CVE-2026-43805CRITICALA race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS SoEPSS 0.5%