CAPEC-25
Forced Deadlock
The adversary triggers and exploits a deadlock condition in the target software to cause a denial of service. A deadlock can occur when two or more competing actions are waiting for each other to finish, and thus neither ever does. Deadlock conditions can be difficult to detect.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-25: Forced Deadlock: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/25.html and https://cve.bz/cve/capec/25?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
The adversary initiates an exploratory phase to get familiar with the system.
The adversary triggers a first action (such as holding a resource) and initiates a second action which will wait for the first one to finish.
If the target program has a deadlock condition, the program waits indefinitely resulting in a denial of service.
Prerequisites
The target host has a deadlock condition. There are four conditions for a deadlock to occur, known as the Coffman conditions. [REF-101]
The target host exposes an API to the user.
Skills required
- Medium skill
This type of attack may be sophisticated and require knowledge about the system's resources and APIs.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Resource Consumption | Availability | A successful forced deadlock attack compromises the availability of the system by exhausting its available resources. |
Mitigations
Use known algorithm to avoid deadlock condition (for instance non-blocking synchronization algorithms).
For competing actions, use well-known libraries which implement synchronization.
Weaknesses it exploits
- CWE-412 Unrestricted Externally Accessible Lock
- CWE-567 Unsynchronized Access to Shared Data in a Multithreaded Context
- CWE-662 Improper Synchronization
- CWE-667 Improper Locking
- CWE-833 Deadlock
- CWE-1322 Use of Blocking Code in Single-threaded, Non-blocking Context
Recent CVEs with these weaknesses
- 7.5CVE-2026-120399
A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected list…
- 6.8CVE-2026-125220
FFmpeg through 9.0.2 contains a deadlock vulnerability in mimic_decode_frame() in libavcodec/mimic.c that fails to report frame progress when init_get_bits8() fails. Attackers can supply a crafted file with an oversized Mimic intra frame f…
- 2.5CVE-2026-112907
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wa…
- 6.8CVE-2026-118052
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arith…
- 8.2CVE-2026-61854
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanu…
- 8.2CVE-2026-119574
Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connection…
- 5.9CVE-2026-118593
A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still di…
- 7.5CVE-2026-106174
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP…
The newest records naming one of them. Each weakness's page lists them all.
Examples
An example of a deadlock which may occur in database products is the following. Client applications using the…
An example of a deadlock which may occur in database products is the following. Client applications using the database may require exclusive access to a table, and in order to gain exclusive access they ask for a lock. If one client application holds a lock on a table and attempts to obtain the lock on a second table that is already held by a second client application, this may lead to deadlock if the second application then attempts to obtain the lock that is held by the first application (Source: Wikipedia, http://en.wikipedia.org/wiki/Deadlock)
MITRE's words, unchanged: CAPEC-25 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.