Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-7208MEDIUMYealink SIP-T33G < 124.87.0.0 Race Condition via Diagnostic File DeletionEPSS 0.2%CVE-2026-62429MEDIUMvNUMA domain cleanup may race other operationsEPSS 0.2%CVE-2026-10565LOWOpen5GS NGAP Handover gmm-sm.c gmm_state_security_mode race conditionEPSS 0.2%CVE-2026-16211LOWallegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race conditionEPSS 0.2%CVE-2023-6531HIGHKernel: gc's deletion of an skb races with unix_stream_read_generic() leading to uafEPSS 0.2%CVE-2026-85639MEDIUMjofpin trape Telemetry Endpoint user.py race conditionEPSS 0.2%CVE-2024-26307MEDIUMApache Doris: Possible race conditionEPSS 0.2%CVE-2026-58616MEDIUMCopilot Chat (Microsoft Edge) Information Disclosure VulnerabilityEPSS 0.2%CVE-2024-27020HIGHnetfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()EPSS 0.2%CVE-2026-17822MEDIUMRace in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML paEPSS 0.2%CVE-2026-17841MEDIUMRace in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML paEPSS 0.2%CVE-2026-17855CRITICALRace in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentEPSS 0.2%CVE-2023-23039MEDIUMAn issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physEPSS 0.2%CVE-2024-40887MEDIUMRace condition in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an unauthenticatEPSS 0.2%CVE-2026-70582MEDIUMWindows Management Instrumentation Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2021-20321—A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OveEPSS 0.2%CVE-2025-31188HIGHA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.EPSS 0.2%CVE-2025-30235LOWShearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication atteEPSS 0.2%CVE-2026-58527HIGHWindows Runtime Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2025-64773LOWIn JetBrains YouTrack before 2025.3.104432 a race condition allowed bypass of helpdesk Agent limitEPSS 0.2%