Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-64782LOWA memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10,EPSS 0.3%CVE-2025-1493MEDIUMIBM Db2 denial of serviceEPSS 0.3%CVE-2025-50167HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2020-10684HIGHA flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_faEPSS 0.3%CVE-2026-24297MEDIUMWindows Kerberos Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2024-11144CRITICALRace Condition with LightFTPEPSS 0.3%CVE-2025-27492HIGHWindows Secure Channel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2023-33203MEDIUMThe Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physicallyEPSS 0.3%CVE-2022-26807HIGHWindows Work Folder Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2017-18018HIGHIn GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of theEPSS 0.3%CVE-2025-54955HIGHOpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can leEPSS 0.3%CVE-2026-94043MEDIUMFree5GC Gmm handler.go race conditionEPSS 0.3%CVE-2026-25674LOWPotential incorrect permissions on newly created file system objectsEPSS 0.3%CVE-2024-32477HIGHRace condition when flushing input stream leads to permission prompt bypassEPSS 0.3%CVE-2025-32991CRITICALIn N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.EPSS 0.3%CVE-2025-59052HIGHAngular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data LeakageEPSS 0.3%CVE-2022-1462—An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition usinEPSS 0.3%CVE-2026-33544HIGHTinyauth has OAuth account confusion via shared mutable state on singleton service instancesEPSS 0.3%CVE-2022-44563MEDIUMThere is a race condition vulnerability in SD upgrade mode. Successful exploitation of this vulnerability may affect data confidentiality.EPSS 0.3%CVE-2025-54092HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.3%