Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-61352HIGHRemote Desktop Client Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-6996LOWRace in Frames in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to pEPSS 0.4%CVE-2018-16867HIGHA flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usEPSS 0.4%CVE-2026-53517HIGHBetter Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family ForkingEPSS 0.4%CVE-2026-43631CRITICALllama.cpp b7492–b9060 Use-After-Free RCE via llama-serverEPSS 0.4%CVE-2024-45300HIGHBypassing promo code limitations with race conditionsEPSS 0.4%CVE-2025-53132HIGHWin32k Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2020-28049MEDIUMAn issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unpEPSS 0.4%CVE-2022-40130MEDIUMWordPress WP-Polls plugin <= 2.76.0 - Auth. Race Condition vulnerabilityEPSS 0.4%CVE-2025-54115HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-48069CRITICALA vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files anEPSS 0.4%CVE-2026-28986HIGHA race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, maEPSS 0.4%CVE-2026-21697HIGHaxios4go's Race Condition in Shared HTTP Client Allows Proxy Configuration LeakEPSS 0.4%CVE-2022-24540HIGHWindows ALPC Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-59455MEDIUMIn JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race conditionEPSS 0.4%CVE-2026-54999HIGHWindows TCP/IP Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-53518HIGHBetter Auth OAuth Provider: Race Condition in Authorization Code Exchange Enables Multi-Use Code RedemptionEPSS 0.4%CVE-2026-43805CRITICALA race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS SoEPSS 0.4%CVE-2025-15116MEDIUMOpenCart Single-Use Coupon race conditionEPSS 0.4%CVE-2020-29372MEDIUMAn issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operationEPSS 0.4%