Falhas do tipo CWE-362

1.433 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-91947HIGHFreeRDP Server before 3.31.0 Use-After-Free via DRDYNVCEPSS 0.4%CVE-2026-25674LOWPotential incorrect permissions on newly created file system objectsEPSS 0.4%CVE-2023-6109MEDIUMYOP Poll <= 6.5.26 - Race Condition to Vote ManipulationEPSS 0.4%CVE-2026-34363HIGHParse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribersEPSS 0.4%CVE-2022-48613—Race condition vulnerability in the kernel module. Successful exploitation of this vulnerability may cause variable values to be read with tEPSS 0.4%CVE-2024-47870HIGHRace condition in update_root_in_config may redirect user traffic in GradioEPSS 0.4%CVE-2026-87816HIGHPasswordPusher before 2.11.1 Race Condition View Limit BypassEPSS 0.4%CVE-2025-58145HIGHArm issues with page refcountingEPSS 0.4%CVE-2021-3640—A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER EPSS 0.4%CVE-2026-64210HIGHnet/mlx5e: xsk: Fix unlocked writing to ICOSQEPSS 0.4%CVE-2021-3573—A use-after-free in function hci_sock_bound_ioctl() of the Linux kernel HCI subsystem was found in the way user calls ioct HCIUNBLOCKADDR orEPSS 0.4%CVE-2026-64025CRITICALbpf, skmsg: fix verdict sk_data_ready racing with ktls rxEPSS 0.4%CVE-2026-77633HIGHCloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of serviceEPSS 0.4%CVE-2026-63756CRITICALSurrealDB before 3.1.0 Privilege Escalation via RPC Session Race ConditionEPSS 0.4%CVE-2026-111770HIGHModel Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to anotherEPSS 0.4%CVE-2021-25395MEDIUMA race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilEPSS 0.4%KEVCVE-2024-39554HIGHJunos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crashEPSS 0.4%CVE-2010-5160MEDIUMRace condition in ESET Smart Security 4.2.35.3 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous cEPSS 0.4%CVE-2026-4684HIGHRace condition, use-after-free in the Graphics: WebRender componentEPSS 0.4%CVE-2021-4202—A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could EPSS 0.4%