Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-362 (使用共享资源的并发执行不恰当同步问题(竞争条件)) — Vulnerability Class 422

422 vulnerabilities classified as CWE-362 (使用共享资源的并发执行不恰当同步问题(竞争条件)). AI Chinese analysis included.

CWE-362 represents a concurrency weakness where multiple threads access a shared resource without proper synchronization, creating a timing window for unauthorized modification. Attackers typically exploit this by manipulating execution order to trigger unpredictable behavior, such as privilege escalation or data corruption, by interleaving operations to bypass security checks or overwrite critical values. Developers mitigate this risk by implementing robust synchronization mechanisms, including mutexes, semaphores, or atomic operations, to ensure exclusive access during critical sections. Additionally, adopting thread-safe design patterns and minimizing shared state can significantly reduce the attack surface. By rigorously testing concurrent code paths and enforcing strict access controls, engineers prevent race conditions, ensuring application integrity and stability under high-concurrency scenarios.

MITRE CWE Description
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. A race condition occurs within concurrent environments, and it is effectively a property of a code sequence. Depending on the context, a code sequence may be in the form of a function call, a small number of instructions, a series of program invocations, etc. A race condition violates these properties, which are closely related: Exclusivity - the code sequence is given exclusive access to the shared resource, i.e., no other code sequence can modify properties of the shared resource before the original sequence has completed execution. Atomicity - the code sequence is behaviorally atomic, i.e., no other thread or process can concurrently execute the same sequence of instructions (or a subset) against the same resource. A race condition exists when an "interfering code sequence" can still access the shared resource, violating exclusivity. The interfering code sequence could be "trusted" or "untrusted." A trusted interfering code sequence occurs within the product; it cannot be modified by the attacker, and it can only be invoked indirectly. An untrusted interfering code sequence can be authored directly by the attacker, and typically it is external to the vulnerable product.
Common Consequences (4)
AvailabilityDoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
When a race condition makes it possible to bypass a resource cleanup routine or trigger multiple initialization routines, it may lead to resource exhaustion.
AvailabilityDoS: Crash, Exit, or Restart, DoS: Instability
When a race condition allows multiple control flows to access a resource simultaneously, it might lead the product(s) into unexpected states, possibly resulting in a crash.
Confidentiality, IntegrityRead Files or Directories, Read Application Data
When a race condition is combined with predictable resource names and loose permissions, it may be possible for an attacker to overwrite or access confidential data (CWE-59).
Access ControlExecute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism
This can have security implications when the expected synchronization is in security-critical code, such as recording whether a user is authenticated or modifying important state information that should not be influenced by an outsider.
Mitigations (5)
Architecture and DesignIn languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Architecture and DesignUse thread-safe capabilities such as the data access abstraction in Spring.
Architecture and DesignMinimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
ImplementationWhen using multithreading and operating on shared variables, only use thread-safe functions.
ImplementationUse atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Examples (2)
This code could be used in an e-commerce application that supports transfers between accounts. It takes the total amount of the transfer, sends it to the new account, and deducts the amount from the original account.
$transfer_amount = GetTransferAmount(); $balance = GetBalanceFromDatabase(); if ($transfer_amount < 0) { FatalError("Bad Transfer Amount"); } $newbalance = $balance - $transfer_amount; if (($balance - $transfer_amount) < 0) { FatalError("Insufficient Funds"); } SendNewBalanceToDatabase($newbalance); NotifyUser("Transfer of $transfer_amount succeeded."); NotifyUser("New balance: $newbalance");
Bad · Perl
In the following pseudocode, the attacker makes two simultaneous calls of the program, CALLER-1 and CALLER-2. Both callers are for the same user account. CALLER-1 (the attacker) is associated with PROGRAM-1 (the instance that handles CALLER-1). CALLER-2 is associated with PROGRAM-2. CALLER-1 makes a transfer request of 80.00. PROGRAM-1 calls GetBalanceFromDatabase and sets $balance to 100.00 PROGRAM-1 calculates $newbalance as 20.00, then calls SendNewBalanceToDatabase(). Due to high server load, the PROGRAM-1 call to SendNewBalanceToDatabase() encounters a delay. CALLER-2 makes a transfer req
Attack · Other
The following function attempts to acquire a lock in order to perform operations on a shared resource.
void f(pthread_mutex_t *mutex) { pthread_mutex_lock(mutex); /* access shared resource */ pthread_mutex_unlock(mutex); }
Bad · C
int f(pthread_mutex_t *mutex) { int result; result = pthread_mutex_lock(mutex); if (0 != result) return result; /* access shared resource */ return pthread_mutex_unlock(mutex); }
Good · C
CVE IDTitleCVSSSeverityPublished
CVE-2026-26071 EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free — everest-core 4.2 Medium2026-03-26
CVE-2026-26070 EVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point Crash — everest-core 4.6 Medium2026-03-26
CVE-2025-33254 NVIDIA Triton Inference Server 竞争条件问题漏洞 — Triton Inference Server 7.5 High2026-03-24
CVE-2025-33238 NVIDIA Triton Inference Server 竞争条件问题漏洞 — Triton Inference Server 7.5 High2026-03-24
CVE-2026-32887 Effect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC — effect 7.4 High2026-03-20
CVE-2026-32018 OpenClaw < 2026.2.19 - Race Condition in Sandbox Registry Write Operations — OpenClaw 3.6 Low2026-03-19
CVE-2026-32723 SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race) — SandboxJS 9.8 -2026-03-18
CVE-2026-32700 Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to — devise 5.3 -2026-03-18
CVE-2026-32398 WordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerability — TeraWallet – For WooCommerce 6.5 Medium2026-03-13
CVE-2026-32242 Parse Server OAuth2 adapter shares mutable state across providers via singleton instance — parse-server 8.2AIHighAI2026-03-12
CVE-2026-31827 Alienbin: TTL Index Race Condition allows unauthorized deletion of other users data — Alienbin 5.3AIMediumAI2026-03-10
CVE-2026-31824 Sylius has a Promotion Usage Limit Bypass via Race Condition — Sylius 8.2 High2026-03-10
CVE-2026-24296 Windows Device Association Service Elevation of Privilege Vulnerability — Windows 10 Version 1607 7.0 High2026-03-10
CVE-2026-24297 Windows Kerberos Security Feature Bypass Vulnerability — Windows 10 Version 1607 6.5 Medium2026-03-10
CVE-2026-24295 Windows Device Association Service Elevation of Privilege Vulnerability — Windows 10 Version 1607 7.0 High2026-03-10
CVE-2026-23671 Windows Bluetooth RFCOM Protocol Driver Elevation of Privilege Vulnerability — Windows 10 Version 1607 7.0 High2026-03-10
CVE-2026-23668 Windows Graphics Component Elevation of Privilege Vulnerability — Windows 10 Version 1607 7.0 High2026-03-10
CVE-2026-28789 OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling — OliveTin 7.5 High2026-03-05
CVE-2026-28551 Huawei HarmonyOS 安全漏洞 — HarmonyOS 4.7 Medium2026-03-05
CVE-2026-28549 Huawei HarmonyOS 安全漏洞 — HarmonyOS 6.6 Medium2026-03-05
CVE-2026-28543 Huawei HarmonyOS 安全漏洞 — HarmonyOS 4.4 Medium2026-03-05
CVE-2026-28545 Huawei HarmonyOS 安全漏洞 — HarmonyOS 5.9 Medium2026-03-05
CVE-2026-28544 Huawei HarmonyOS 安全漏洞 — HarmonyOS 6.2 Medium2026-03-05
CVE-2026-25674 Potential incorrect permissions on newly created file system objects — Django 6.5 -2026-03-03
CVE-2026-0995 ARM C1-Pro 安全漏洞 — C1 Pro 6.7AIMediumAI2026-03-02
CVE-2026-26201 emp3r0r Affected by Concurrent Map Access DoS (panic/crash) — emp3r0r 6.5AIMediumAI2026-02-19
CVE-2026-2319 Google Chrome 安全漏洞 — Chrome 7.5AIHighAI2026-02-11
CVE-2026-21231 Windows Kernel Elevation of Privilege Vulnerability — Windows 10 Version 1607 7.8 High2026-02-10
CVE-2026-21237 Windows Subsystem for Linux Elevation of Privilege Vulnerability — Windows 10 Version 21H2 7.0 High2026-02-10
CVE-2026-21234 Windows Connected Devices Platform Service Elevation of Privilege Vulnerability — Windows 10 Version 1809 7.0 High2026-02-10

Vulnerabilities classified as CWE-362 (使用共享资源的并发执行不恰当同步问题(竞争条件)) represent 422 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.