Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CWE-362 (使用共享资源的并发执行不恰当同步问题(竞争条件)) — Vulnerability Class 588

588 vulnerabilities classified as CWE-362 (使用共享资源的并发执行不恰当同步问题(竞争条件)). AI Chinese analysis included.

CWE-362 represents a concurrency weakness where multiple threads access a shared resource without proper synchronization, creating a timing window for unauthorized modification. Attackers typically exploit this by manipulating execution order to trigger unpredictable behavior, such as privilege escalation or data corruption, by interleaving operations to bypass security checks or overwrite critical values. Developers mitigate this risk by implementing robust synchronization mechanisms, including mutexes, semaphores, or atomic operations, to ensure exclusive access during critical sections. Additionally, adopting thread-safe design patterns and minimizing shared state can significantly reduce the attack surface. By rigorously testing concurrent code paths and enforcing strict access controls, engineers prevent race conditions, ensuring application integrity and stability under high-concurrency scenarios.

MITRE CWE Description
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. A race condition occurs within concurrent environments, and it is effectively a property of a code sequence. Depending on the context, a code sequence may be in the form of a function call, a small number of instructions, a series of program invocations, etc. A race condition violates these properties, which are closely related: Exclusivity - the code sequence is given exclusive access to the shared resource, i.e., no other code sequence can modify properties of the shared resource before the original sequence has completed execution. Atomicity - the code sequence is behaviorally atomic, i.e., no other thread or process can concurrently execute the same sequence of instructions (or a subset) against the same resource. A race condition exists when an "interfering code sequence" can still access the shared resource, violating exclusivity. The interfering code sequence could be "trusted" or "untrusted." A trusted interfering code sequence occurs within the product; it cannot be modified by the attacker, and it can only be invoked indirectly. An untrusted interfering code sequence can be authored directly by the attacker, and typically it is external to the vulnerable product.
Common Consequences (4)
AvailabilityDoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
When a race condition makes it possible to bypass a resource cleanup routine or trigger multiple initialization routines, it may lead to resource exhaustion.
AvailabilityDoS: Crash, Exit, or Restart, DoS: Instability
When a race condition allows multiple control flows to access a resource simultaneously, it might lead the product(s) into unexpected states, possibly resulting in a crash.
Confidentiality, IntegrityRead Files or Directories, Read Application Data
When a race condition is combined with predictable resource names and loose permissions, it may be possible for an attacker to overwrite or access confidential data (CWE-59).
Access ControlExecute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism
This can have security implications when the expected synchronization is in security-critical code, such as recording whether a user is authenticated or modifying important state information that should not be influenced by an outsider.
Mitigations (5)
Architecture and DesignIn languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Architecture and DesignUse thread-safe capabilities such as the data access abstraction in Spring.
Architecture and DesignMinimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring. Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
ImplementationWhen using multithreading and operating on shared variables, only use thread-safe functions.
ImplementationUse atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Examples (2)
This code could be used in an e-commerce application that supports transfers between accounts. It takes the total amount of the transfer, sends it to the new account, and deducts the amount from the original account.
$transfer_amount = GetTransferAmount(); $balance = GetBalanceFromDatabase(); if ($transfer_amount < 0) { FatalError("Bad Transfer Amount"); } $newbalance = $balance - $transfer_amount; if (($balance - $transfer_amount) < 0) { FatalError("Insufficient Funds"); } SendNewBalanceToDatabase($newbalance); NotifyUser("Transfer of $transfer_amount succeeded."); NotifyUser("New balance: $newbalance");
Bad · Perl
In the following pseudocode, the attacker makes two simultaneous calls of the program, CALLER-1 and CALLER-2. Both callers are for the same user account. CALLER-1 (the attacker) is associated with PROGRAM-1 (the instance that handles CALLER-1). CALLER-2 is associated with PROGRAM-2. CALLER-1 makes a transfer request of 80.00. PROGRAM-1 calls GetBalanceFromDatabase and sets $balance to 100.00 PROGRAM-1 calculates $newbalance as 20.00, then calls SendNewBalanceToDatabase(). Due to high server load, the PROGRAM-1 call to SendNewBalanceToDatabase() encounters a delay. CALLER-2 makes a transfer req
Attack · Other
The following function attempts to acquire a lock in order to perform operations on a shared resource.
void f(pthread_mutex_t *mutex) { pthread_mutex_lock(mutex); /* access shared resource */ pthread_mutex_unlock(mutex); }
Bad · C
int f(pthread_mutex_t *mutex) { int result; result = pthread_mutex_lock(mutex); if (0 != result) return result; /* access shared resource */ return pthread_mutex_unlock(mutex); }
Good · C
CVE IDTitleCVSSSeverityPublished
CVE-2026-34850 Huawei HarmonyOS 安全漏洞 — HarmonyOS 1.9 Low2026-04-13
CVE-2026-5774 Juju API Server Denial of Service and Authentication Replay via Unsynchronized Token Map — Juju 8.8 -2026-04-10
CVE-2026-5902 Google Chrome 竞争条件问题漏洞 — Chrome 5.3AIMediumAI2026-04-08
CVE-2026-5893 Google Chrome 竞争条件问题漏洞 — Chrome 7.5AIHighAI2026-04-08
CVE-2026-5890 Google Chrome 竞争条件问题漏洞 — Chrome 5.3AIMediumAI2026-04-08
CVE-2026-39880 Remnawave Backend has a race condition in HWID device limit allows bypassing max devices — backend 5.0 Medium2026-04-08
CVE-2026-33544 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances — tinyauth 7.7 High2026-04-02
CVE-2026-35099 Lakeside SysTrack Agent 安全漏洞 — SysTrack Agent 7.4 High2026-04-01
CVE-2026-34363 Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers — parse-server 7.5AIHighAI2026-03-31
CVE-2026-33028 Nginx UI: Race Condition Leads to Persistent Data Corruption and Service Collapse — nginx-ui 8.1 -2026-03-30
CVE-2026-33872 elixir-nodejs has Cross-User Data Leakage or Information Disclosure due to Worker Protocol Race Condition — elixir-nodejs 5.9 -2026-03-27
CVE-2026-34368 AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance — AVideo 5.3 Medium2026-03-27
CVE-2026-33009 EVerest: MQTT Switch-Phases Command Data Race Causing Charger State Corruptio — everest-core 8.2 High2026-03-26
CVE-2026-27814 EVerest EvseManager phase-switch path has unsynchronized shared-state access race condition — everest-core 4.2 Medium2026-03-26
CVE-2026-26074 EVerest: OCPP201 startup event_queue lock mismatch leads to std::map/std::queue data race — everest-core 7.0 High2026-03-26
CVE-2026-26072 EVerest has race-condition-induced std::map corruption in OCPP 1.6 evse_soc_map — everest-core 4.2 Medium2026-03-26
CVE-2026-26071 EVerest: OCPP 2.0.1 EVCCID Data Race Leads to Heap Use‑After‑Free — everest-core 4.2 Medium2026-03-26
CVE-2026-26070 EVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point Crash — everest-core 4.6 Medium2026-03-26
CVE-2025-33254 NVIDIA Triton Inference Server 竞争条件问题漏洞 — Triton Inference Server 7.5 High2026-03-24
CVE-2025-33238 NVIDIA Triton Inference Server 竞争条件问题漏洞 — Triton Inference Server 7.5 High2026-03-24
CVE-2026-32887 Effect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC — effect 7.4 High2026-03-20
CVE-2026-32018 OpenClaw < 2026.2.19 - Race Condition in Sandbox Registry Write Operations — OpenClaw 3.6 Low2026-03-19
CVE-2026-32723 SandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race) — SandboxJS 9.8 -2026-03-18
CVE-2026-32700 Devise has a confirmable "change email" race condition that permits user to confirm email they have no access to — devise 5.3 -2026-03-18
CVE-2026-32398 WordPress TeraWallet – For WooCommerce plugin <= 1.5.15 - Race Condition vulnerability — TeraWallet – For WooCommerce 6.5 Medium2026-03-13
CVE-2026-32242 Parse Server OAuth2 adapter shares mutable state across providers via singleton instance — parse-server 8.2AIHighAI2026-03-12
CVE-2026-31827 Alienbin: TTL Index Race Condition allows unauthorized deletion of other users data — Alienbin 5.3AIMediumAI2026-03-10
CVE-2026-31824 Sylius has a Promotion Usage Limit Bypass via Race Condition — Sylius 8.2 High2026-03-10
CVE-2026-24297 Windows Kerberos Security Feature Bypass Vulnerability — Windows 10 Version 1607 6.5 Medium2026-03-10
CVE-2026-24296 Windows Device Association Service Elevation of Privilege Vulnerability — Windows 10 Version 1607 7.0 High2026-03-10

Vulnerabilities classified as CWE-362 (使用共享资源的并发执行不恰当同步问题(竞争条件)) represent 588 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.