CWE-366: Race Condition within a Thread
Filter
If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
What the weakness is: CWE-366 at MITRE. All weaknesses
Related attack patterns (CAPEC): 2
- CAPEC-26 Leveraging Race Conditions Likelihood: High · Severity: High
- CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions Likelihood: High · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-366, as MITRE names them. Credits.
Ask an AI about CWE-366
Show the prompt
Explain CWE-366: Race Condition within a Thread and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/366.html and https://cve.bz/cve/cwe/366?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.4CVE-2026-86247EPSS 0.2%
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, fro…
- 8.1CVE-2026-25687EPSS 0.4%
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a denial of service (client crash) and potentially arbitrary code execution in the context of the ZCC …
- 7.8CVE-2026-46181EPSS 0.1%
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() Sashiko points out the radix_tree itself is RCU safe, but nothing ever frees the mlx4_srq struct with RCU, and it isn't…
- 7.5CVE-2026-23666EPSS 1.3%
Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.
- 6.2CVE-2026-3904EPSS 0.2%
Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client may call memcmp on inputs that are concurrently modified b…
- 5.9CVE-2026-23684EPSS 0.2%
A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to h…
- 3.1CVE-2026-22819EPSS 0.2%
Outray openSource ngrok alternative. Prior to 0.1.5, this vulnerability allows a user i.e a free plan user to get more than the desired subdomains due to lack of db transaction lock mechanisms in main/apps/web/src/routes/api/$orgSlug/subdo…
- 9.8CVE-2025-58143EPSS 0.4%
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: …
- 8.7CVE-2025-31115EPSS 0.7%
XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects includ…
- 7.0CVE-2024-10630EPSS 0.2%
A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality.
- 7.5CVE-2024-6778EPSS 0.8%
Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severit…
- 3.1CVE-2024-2032EPSS 0.3%
A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5.…
- 7.0CVE-2023-6546EPSS 0.7%
A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use…
- 4.7CVE-2023-4732EPSS 0.2%
A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.
- 5.9CVE-2023-4127EPSS 0.5%
Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1.
- 4.4CVE-2023-3218EPSS 0.5%
Race Condition within a Thread in GitHub repository it-novum/openitcockpit prior to 4.6.5.
- 8.1CVE-2015-10067EPSS 0.6%
A vulnerability was found in oznetmaster SSharpSmartThreadPool. It has been classified as problematic. This affects an unknown part of the file SSharpSmartThreadPool/SmartThreadPool.cs. The manipulation leads to race condition within a thr…
- 7.0CVE-2022-1729EPSS 0.3%
A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit primitives such as kernel address information leak, arbitrary …
- 8.1CVE-2021-26569EPSS 2.3%
Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.
- 5.9CVE-2020-1629EPSS 0.7%
A race condition vulnerability on Juniper Network Junos OS devices may cause the routing protocol daemon (RPD) process to crash and restart while processing a BGP NOTIFICATION message. This issue affects Juniper Networks Junos OS: 16.1 ver…