Falhas do tipo CWE-362

1.433 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2025-66446HIGHMaxKB has a Python sandbox LD_PRELOAD bypassEPSS 0.3%CVE-2024-49353HIGHIBM Watson Speech Services Cartridge for IBM Cloud Pak for Data denial of serviceEPSS 0.3%CVE-2026-42594HIGHGotenberg: Unauthenticated denial of service via echo.Context pool reuse in webhook async goroutineEPSS 0.3%CVE-2026-86766HIGHSnipe-IT 8.6.3 Race Condition via Consumable CheckoutEPSS 0.3%CVE-2026-7208MEDIUMYealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File DeletionEPSS 0.3%CVE-2026-85639MEDIUMjofpin trape Telemetry Endpoint user.py race conditionEPSS 0.3%CVE-2022-26807HIGHWindows Work Folder Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-32991CRITICALIn N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.EPSS 0.3%CVE-2017-18018HIGHIn GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of theEPSS 0.3%CVE-2026-117507MEDIUMa2aproject a2a-java TaskManager.saveTaskEvent race conditionEPSS 0.3%CVE-2025-54092HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-47735LOWinner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization.EPSS 0.3%CVE-2024-32477HIGHRace condition when flushing input stream leads to permission prompt bypassEPSS 0.3%CVE-2025-45731MEDIUMA group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operaEPSS 0.3%CVE-2026-63980HIGHnet/handshake: Use spin_lock_bh for hn_lockEPSS 0.3%CVE-2022-1462—An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition usinEPSS 0.3%CVE-2026-44102MEDIUMOCPP Firmware download is not properly lockedEPSS 0.3%CVE-2026-46316CRITICALKVM: arm64: vgic-its: Drop the translation cache reference only for the erased entryEPSS 0.3%CVE-2026-106500HIGHBackstage: Improper task state validation in Scaffolder backendEPSS 0.3%CVE-2026-112459HIGHA race condition was addressed with improved state handling. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 2EPSS 0.3%