Falhas do tipo CWE-362

1.433 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-41458HIGHOwnTone Server < 29.1 Race Condition DoS via DAAP LoginEPSS 0.4%CVE-2023-2006HIGHA race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from theEPSS 0.4%CVE-2023-36405HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-47827MEDIUMArgo Workflows Controller: Denial of Service via malicious daemon WorkflowsEPSS 0.4%CVE-2024-24254MEDIUMPX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability iEPSS 0.4%CVE-2026-50348HIGHWindows Runtime Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-50452HIGHWindows Runtime Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-47545MEDIUMWordPress Poll Maker plugin <= 5.7.7 - Race Condition VulnerabilityEPSS 0.4%CVE-2024-58248LOWnopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cardsEPSS 0.4%CVE-2026-118128MEDIUMa2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race conditionEPSS 0.4%CVE-2017-15129—A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_idEPSS 0.4%CVE-2025-59052HIGHAngular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data LeakageEPSS 0.4%CVE-2025-55224HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.4%CVE-2025-27492HIGHWindows Secure Channel Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-45675HIGHOpen WebUI: LDAP and OAuth First-User Race Condition Allows Multiple Admin AccountsEPSS 0.4%CVE-2022-44032MEDIUMAn issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4000_cs.c has a race condition and resultant use-after-freeEPSS 0.4%CVE-2026-33544HIGHTinyauth has OAuth account confusion via shared mutable state on singleton service instancesEPSS 0.4%CVE-2023-33203MEDIUMThe Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physicallyEPSS 0.4%CVE-2024-11708MEDIUMMissing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affecEPSS 0.4%CVE-2024-11144CRITICALRace Condition with LightFTPEPSS 0.4%