CWE-366
Race Condition within a Thread
Description
If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
Hierarchy (View 1000)
Parents
Children
none
Related attack patterns (CAPEC)
CAPEC-26 · CAPEC-29
CVEs mapped to this weakness (19)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-58143 | Cri | 0.64 | 9.8 | 0.00 | Sep 11, 2025 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the… | ||
| CVE-2021-26569 | Cri | 0.64 | 9.8 | 0.02 | Mar 12, 2021 | Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests. | ||
| CVE-2024-10630 | Hig | 0.51 | 7.8 | 0.00 | Jan 14, 2025 | A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality. | ||
| CVE-2025-31115 | Hig | 0.50 | — | 0.01 | Apr 3, 2025 | XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an… | ||
| CVE-2026-23666 | Hig | 0.49 | 7.5 | 0.01 | Apr 14, 2026 | Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network. | ||
| CVE-2024-6778 | Hig | 0.49 | 7.5 | 0.01 | Jul 16, 2024 | Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High) | ||
| CVE-2023-6546 | Hig | 0.46 | 7.0 | 0.01 | Dec 21, 2023 | A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci… | ||
| CVE-2026-46181 | Hig | 0.44 | 7.8 | 0.00 | May 28, 2026 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within the RCU critical… | ||
| CVE-2026-23684 | Med | 0.38 | 5.9 | 0.00 | Feb 10, 2026 | A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data integrity, with no… | ||
| CVE-2021-38191 | Med | 0.38 | 5.9 | 0.01 | Aug 8, 2021 | An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread. | ||
| CVE-2020-1629 | Med | 0.38 | 5.9 | 0.01 | Apr 8, 2020 | A race condition vulnerability on Juniper Network Junos OS devices may cause the routing protocol daemon (RPD) process to crash and restart while processing a BGP NOTIFICATION message. This issue affects Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S6; 16.2 versions… | ||
| CVE-2026-3904 | Med | 0.33 | 6.2 | 0.00 | Mar 11, 2026 | Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on inputs that are concurrently modified by other processes or threads and crash. … | ||
| CVE-2026-22819 | Med | 0.31 | 5.9 | 0.00 | Jan 14, 2026 | Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This vulnerability is… | ||
| CVE-2023-4732 | Med | 0.31 | 4.7 | 0.00 | Oct 3, 2023 | A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x. | ||
| CVE-2023-4127 | Med | 0.31 | 5.9 | 0.00 | Aug 3, 2023 | Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1. | ||
| CVE-2015-10067 | Med | 0.23 | 4.6 | 0.01 | Jan 18, 2023 | A vulnerability was found in oznetmaster SSharpSmartThreadPool. It has been classified as problematic. This affects an unknown part of the file SSharpSmartThreadPool/SmartThreadPool.cs. The manipulation leads to race condition within a thread. The complexity of an attack is… | ||
| CVE-2024-2032 | Low | 0.13 | 3.1 | 0.00 | Jun 6, 2024 | A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to… | ||
| CVE-2023-3218 | Med | 0.00 | 4.4 | 0.00 | Jun 13, 2023 | Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5. | ||
| CVE-2022-1729 | Hig | 0.00 | 7.0 | 0.00 | Sep 1, 2022 | A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc. |
- risk 0.64cvss 9.8epss 0.00
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the…
- risk 0.64cvss 9.8epss 0.02
Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.
- risk 0.51cvss 7.8epss 0.00
A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality.
- risk 0.50cvss —epss 0.01
XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an…
- risk 0.49cvss 7.5epss 0.01
Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.
- risk 0.49cvss 7.5epss 0.01
Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)
- risk 0.46cvss 7.0epss 0.01
A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci…
- risk 0.44cvss 7.8epss 0.00
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't even accessed within the RCU critical…
- risk 0.38cvss 5.9epss 0.00
A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data integrity, with no…
- risk 0.38cvss 5.9epss 0.01
An issue was discovered in the tokio crate before 1.8.1 for Rust. Upon a JoinHandle::abort, a Task may be dropped in the wrong thread.
- risk 0.38cvss 5.9epss 0.01
A race condition vulnerability on Juniper Network Junos OS devices may cause the routing protocol daemon (RPD) process to crash and restart while processing a BGP NOTIFICATION message. This issue affects Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S6; 16.2 versions…
- risk 0.33cvss 6.2epss 0.00
Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on inputs that are concurrently modified by other processes or threads and crash. …
- risk 0.31cvss 5.9epss 0.00
Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. This vulnerability is…
- risk 0.31cvss 4.7epss 0.00
A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.
- risk 0.31cvss 5.9epss 0.00
Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1.
- risk 0.23cvss 4.6epss 0.01
A vulnerability was found in oznetmaster SSharpSmartThreadPool. It has been classified as problematic. This affects an unknown part of the file SSharpSmartThreadPool/SmartThreadPool.cs. The manipulation leads to race condition within a thread. The complexity of an attack is…
- risk 0.13cvss 3.1epss 0.00
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to…
- risk 0.00cvss 4.4epss 0.00
Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.
- risk 0.00cvss 7.0epss 0.00
A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary execution, etc.