Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2025-54919HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 0.4%CVE-2020-1641MEDIUMJunos OS: A race condition on receipt of crafted LLDP packets leads to a memory leak and an LLDP crash.EPSS 0.4%CVE-2026-17711CRITICALRace in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenEPSS 0.4%CVE-2026-78934HIGHRace condition in ReadAloud in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitEPSS 0.4%CVE-2025-26649HIGHWindows Secure Channel Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-57030HIGHJunos OS: SRX Series: Flow sessions are not getting cleared leading to a DoSEPSS 0.4%CVE-2023-30543MEDIUM`chainId` may be outdated if user changes chains as part of connection in @web3-reactEPSS 0.4%CVE-2025-21947HIGHksmbd: fix type confusion via race condition when using ipc_msg_send_requestEPSS 0.4%CVE-2023-6109MEDIUMYOP Poll <= 6.5.26 - Race Condition to Vote ManipulationEPSS 0.4%CVE-2021-3640—A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER EPSS 0.4%CVE-2021-3573—A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR orEPSS 0.4%CVE-2024-47870HIGHRace condition in update_root_in_config may redirect user traffic in GradioEPSS 0.4%CVE-2026-63756CRITICALSurrealDB before 3.1.0 Privilege Escalation via RPC Session Race ConditionEPSS 0.4%CVE-2026-77633HIGHCloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of serviceEPSS 0.4%CVE-2026-34363HIGHParse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribersEPSS 0.4%CVE-2024-39554HIGHJunos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crashEPSS 0.4%CVE-2010-5160MEDIUMRace condition in ESET Smart Security 4.2.35.3 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous cEPSS 0.4%CVE-2021-25395MEDIUMA race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilEPSS 0.4%KEVCVE-2021-4202—A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could EPSS 0.4%CVE-2026-41458HIGHOwnTone Server < 29.1 Race Condition DoS via DAAP LoginEPSS 0.4%