Fallos del tipo CWE-366

18 resultados

Condição de corrida entre threads

Ocorre quando múltiplas threads acessam e modificam o mesmo recurso (variável, arquivo, conexão) sem sincronização adequada, causando comportamento imprevisível e potencialmente perigoso. O resultado depende da ordem de execução das threads, que é não-determinística e difícil de reproduzir.

Ejemplo

Um servidor web mantém um contador de sessões ativas em uma variável compartilhada. Duas threads recebem requisições simultâneas, leem o valor 100, incrementam para 101 e escrevem de volta — resultado final é 101 em vez de 102. Em cenários críticos (controle de acesso, transferências), isso permite fraudes ou bypass de validações.

Cómo mitigar

Use mecanismos de sincronização (locks, mutexes, semáforos) ao acessar recursos compartilhados, ou redesenhe para evitar compartilhamento — use estruturas thread-safe (AtomicInteger em Java, canais em Go) e operações atômicas. Revise todo acesso a estado mutável compartilhado em código multi-thread.

CVE-2021-26569CRITICALRace Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows rEPSS 2.2%CVE-2026-23666HIGH.NET Framework Denial of Service VulnerabilityEPSS 1.3%CVE-2024-6778HIGHRace in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to injecEPSS 0.8%CVE-2023-6546HIGHKernel: gsm multiplexing race condition leads to privilege escalationEPSS 0.8%CVE-2020-1629MEDIUMJunos OS: A race condition vulnerability may cause RPD daemon to crash when processing a BGP NOTIFICATION message.EPSS 0.7%CVE-2025-31115HIGHXZ has a heap-use-after-free bug in threaded .xz decoderEPSS 0.6%CVE-2015-10067MEDIUMoznetmaster SSharpSmartThreadPool SmartThreadPool.cs race conditionEPSS 0.5%CVE-2023-4127MEDIUMRace Condition within a Thread in answerdev/answerEPSS 0.5%CVE-2023-3218MEDIUMRace Condition within a Thread in it-novum/openitcockpitEPSS 0.5%CVE-2025-58143CRITICALMutiple vulnerabilities in the Viridian interfaceEPSS 0.3%CVE-2022-1729—A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. TheEPSS 0.3%CVE-2024-2032LOWRace Condition Vulnerability in zenml-io/zenmlEPSS 0.3%CVE-2024-10630HIGHA race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the applicatiEPSS 0.2%CVE-2026-22819MEDIUMOutray has a Race Condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.tsEPSS 0.2%CVE-2023-4732MEDIUMKernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.hEPSS 0.2%CVE-2026-23684MEDIUMRace condition vulnerability in SAP Commerce CloudEPSS 0.2%CVE-2026-3904MEDIUMCalling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under hEPSS 0.1%CVE-2026-46181HIGHRDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()EPSS 0.1%