Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-53518HIGHBetter Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code RedemptionEPSS 0.4%CVE-2026-21697HIGHaxios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration LeakEPSS 0.4%CVE-2025-15244MEDIUMPHPEMS Purchase Request race conditionEPSS 0.4%CVE-2025-15116MEDIUMOpenCart Single-Use Coupon race conditionEPSS 0.4%CVE-2025-54955HIGHOpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can leEPSS 0.4%CVE-2026-64136CRITICALsmb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()EPSS 0.4%CVE-2025-29841HIGHUniversal Print Management Service Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-48708HIGHOliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command ContaminationEPSS 0.4%CVE-2021-4207—A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->EPSS 0.4%CVE-2025-69871HIGHA race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The fuEPSS 0.4%CVE-2022-50373CRITICALfs: dlm: fix race in lowcommsEPSS 0.4%CVE-2016-15036MEDIUMDeis Workflow Manager race conditionEPSS 0.4%CVE-2020-1641MEDIUMJunos OS: A race condition on receipt of crafted LLDP packets leads to a memory leak and an LLDP crash.EPSS 0.4%CVE-2020-29372MEDIUMAn issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operationEPSS 0.4%CVE-2026-48154MEDIUMGoRest: InMemorySecret2FA race condition allows process crash via concurrent map accessEPSS 0.4%CVE-2024-24770MEDIUMUsername timing attack on recover password/MFA token in vantage6EPSS 0.4%CVE-2026-46135CRITICALnvmet-tcp: fix race between ICReq handling and queue teardownEPSS 0.4%CVE-2026-42909HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-33872HIGHelixir-nodejs has Cross-User Data Leakage or Information Disclosure due to Worker Protocol Race ConditionEPSS 0.4%CVE-2026-103112HIGHKeycloak-services: keycloak-services: account takeover via authentication race using reset-credentials pathEPSS 0.4%