Falhas do tipo CWE-362

1.433 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-103112HIGHKeycloak-services: keycloak-services: account takeover via authentication race using reset-credentials pathEPSS 0.4%CVE-2025-21947HIGHksmbd: fix type confusion via race condition when using ipc_msg_send_requestEPSS 0.4%CVE-2026-82942HIGHApache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of ServiceEPSS 0.4%CVE-2025-54919HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 0.4%CVE-2022-44563MEDIUMThere is a race condition vulnerability in SD upgrade mode. Successful exploitation of this vulnerability may affect data confidentiality.EPSS 0.4%CVE-2025-26649HIGHWindows Secure Channel Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-53049CRITICALgfs2: add some missing log lockingEPSS 0.4%CVE-2024-0605HIGHUsing a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bEPSS 0.4%CVE-2026-51082HIGHA race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x bEPSS 0.4%CVE-2024-20509MEDIUMA vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unEPSS 0.4%CVE-2026-24297MEDIUMWindows Kerberos Security Feature Bypass VulnerabilityEPSS 0.4%CVE-2024-12747MEDIUMRsync: race condition in rsync handling symbolic linksEPSS 0.4%CVE-2022-3328HIGHRace condition in snap-confine's must_mkdir_and_open_with_perms()EPSS 0.4%CVE-2026-57030HIGHJunos OS: SRX Series: Flow sessions are not getting cleared leading to a DoSEPSS 0.4%CVE-2025-50167HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-64779LOWA memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10,EPSS 0.4%CVE-2023-30543MEDIUM`chainId` may be outdated if user changes chains as part of connection in @web3-reactEPSS 0.4%CVE-2026-26456HIGHA null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccdEPSS 0.4%CVE-2025-1493MEDIUMIBM Db2 denial of serviceEPSS 0.4%CVE-2026-91947HIGHFreeRDP Server before 3.31.0 Use-After-Free via DRDYNVCEPSS 0.4%