Falhas do tipo CWE-362

1.433 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-53517HIGHBetter Auth OAuth Provider: Refresh Token Rotation Race Condition Allows Concurrent Replay and Token Family ForkingEPSS 0.4%CVE-2026-88174HIGHWindows Deployment Services Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-59455MEDIUMIn JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race conditionEPSS 0.4%CVE-2025-54115HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-45300HIGHBypassing promo code limitations with race conditionsEPSS 0.4%CVE-2022-42930HIGHIf two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component. This EPSS 0.4%CVE-2026-55784HIGHfree5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPIEPSS 0.4%CVE-2025-7954MEDIUMRace Condition in Shopware Voucher SubmissionEPSS 0.4%CVE-2020-28049MEDIUMAn issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unpEPSS 0.4%CVE-2026-43199HIGHnet/mlx5e: Fix "scheduling while atomic" in IPsec MAC address queryEPSS 0.4%CVE-2026-47620MEDIUMNVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initializationEPSS 0.4%CVE-2026-78906HIGHRace condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the EPSS 0.4%CVE-2026-85704MEDIUMramon-victor freegpt-webui Jailbreak Mode config.py getJailbreak race conditionEPSS 0.4%CVE-2024-48069CRITICALA vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files anEPSS 0.4%CVE-2026-28986HIGHA race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, maEPSS 0.4%CVE-2022-24540HIGHWindows ALPC Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-31450HIGHext4: publish jinode after initializationEPSS 0.4%CVE-2026-54999HIGHWindows TCP/IP Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-48880MEDIUMFreeScout has Race Condition When Deleting UsersEPSS 0.4%CVE-2026-92050CRITICALSandbox escape due to race condition in the XPConnect componentEPSS 0.4%