Falhas do tipo CWE-362

1.433 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-53715MEDIUMEnvoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lockEPSS 0.5%CVE-2026-64720CRITICALA race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, wEPSS 0.5%CVE-2026-43805CRITICALA race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS SoEPSS 0.5%CVE-2026-64600HIGHxfs: resample the data fork mapping after cycling ILOCKEPSS 0.5%CVE-2023-36698MEDIUMWindows Kernel Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2026-52946HIGHfs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signalingEPSS 0.5%CVE-2026-70250HIGHWindows DHCP Client Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-56297HIGHFreeRDP - Use-After-Free via Race Condition in DRDYNVC Channel CallbackEPSS 0.5%CVE-2026-61352HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.5%CVE-2026-77762HIGHApache Tomcat: Stale HPACK emitter injects trailers into recycled pooled RequestEPSS 0.5%CVE-2026-23450CRITICALnet/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()EPSS 0.5%CVE-2025-53132HIGHWin32k Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2022-40310MEDIUMWordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Race Condition vulnerabilityEPSS 0.5%CVE-2022-48366LOWAn issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.EPSS 0.5%CVE-2024-21601MEDIUMJunos OS: SRX Series: Due to an error in processing TCP events flowd will crashEPSS 0.5%CVE-2025-43531LOWA race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and EPSS 0.5%CVE-2026-35554HIGHApache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race ConditionEPSS 0.5%CVE-2026-28789HIGHOliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handlingEPSS 0.5%CVE-2024-32985MEDIUMStellar-core's Overlay - security fix for DDoS mitigationEPSS 0.4%CVE-2026-52023HIGHAn issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specificalEPSS 0.4%