Weaknesses of type CWE-413

15 results

Travamento inadequado de recursos

Ocorre quando uma aplicação acessa ou modifica um recurso compartilhado (arquivo, memória, banco de dados) sem garantir sincronização adequada entre threads ou processos. Sem locks ou mecanismos de exclusão mútua, múltiplas partes do código podem interferir uma na outra, causando corrupção de dados, condições de corrida (race conditions) e comportamento imprevisto.

Example

Um servidor web que incrementa um contador de requisições sem mutex: duas threads leem o valor 100 simultaneamente, incrementam para 101, e ambas escrevem 101 de volta. O resultado deveria ser 102, mas é 101. Em contextos de segurança, isso pode levar a bypass de limites de taxa, validações quebradas ou alteração de estado crítico.

How to mitigate

Use mecanismos de sincronização nativos da linguagem (mutexes, semáforos, locks) ao acessar recursos compartilhados. Para dados críticos, prefira estruturas thread-safe ou implemente filas sincronizadas. Revise código multi-thread com ferramentas de análise estática e testes de race condition.

CVE-2026-32748HIGHSquid has Denial of Service in ICP Response handlingEPSS 8.9%CVE-2019-17102HIGHBitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)EPSS 1.9%CVE-2022-24946HIGHImproper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V firmware versions "16" and prior, Mitsubishi EleEPSS 1.6%CVE-2022-20678HIGHCisco IOS XE Software AppNav-XE Denial of Service VulnerabilityEPSS 0.9%CVE-2023-28649HIGHThe Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A vulnerability existsEPSS 0.5%CVE-2023-33951MEDIUMKernel: vmwgfx: race condition leading to information disclosure vulnerabilityEPSS 0.3%CVE-2022-49737HIGHIn X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various dataEPSS 0.3%CVE-2023-32253MEDIUMKernel: deadlock in ksmbd_find_crypto_ctx()EPSS 0.3%CVE-2025-3450CRITICALAutomation Runtime SDM requests may impact systemEPSS 0.3%CVE-2026-44608MEDIUMUse after free and crash under special conditions in RPZ codeEPSS 0.3%CVE-2023-2269—A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dmEPSS 0.2%CVE-2019-8998HIGHAn information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the /proc filesystem) ofEPSS 0.2%CVE-2025-69198MEDIUMPterodactyl's improper resource locking allows raced queries to create more resources than allotedEPSS 0.2%CVE-2025-0003HIGHInadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in EPSS 0.2%CVE-2023-2430MEDIUMA vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c in Linux Kernel. This flaw allows EPSS 0.2%