Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2024-50313MEDIUMA vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mechanism is used by theEPSS 0.3%CVE-2023-42756MEDIUMKernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swapEPSS 0.3%CVE-2026-50139MEDIUMgoshs: Share-link ?token=… redemption races past download limitEPSS 0.3%CVE-2023-37904LOWDiscourse Race Condition in Accept InviteEPSS 0.3%CVE-2025-49762HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-1247—An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many EPSS 0.3%CVE-2024-9936MEDIUMWhen manipulating the selection node cache, an attacker may have been able to cause unexpected behavior, potentially leading to an exploitabEPSS 0.3%CVE-2026-50013HIGHHoverfly: Process Crash via Concurrent Map Write Race Condition in Diff ModeEPSS 0.3%CVE-2026-21234HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-21237HIGHWindows Subsystem for Linux Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-32887HIGHEffect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPCEPSS 0.3%CVE-2026-43728HIGHThis issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26.6. An attacker may be able to modify the sEPSS 0.3%CVE-2026-24040MEDIUMjsPDF has a Shared State Race Condition in addJS PluginEPSS 0.3%CVE-2025-53135HIGHDirectX Graphics Kernel Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-44318MEDIUMfree5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on SubscriptionsEPSS 0.3%CVE-2022-50350CRITICALscsi: target: iscsi: Fix a race condition between login_work and the login threadEPSS 0.3%CVE-2025-55328HIGHWindows Hyper-V Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-8880HIGHRace in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML EPSS 0.3%CVE-2026-26456HIGHA null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccdEPSS 0.3%CVE-2025-48751LOWThe process_lock crate 0.1.0 for Rust allows data races in unlock.EPSS 0.3%