CWE-414 Missing Lock Check

A product does not check to see if a lock is present before performing sensitive operations on a resource.

• Integrity, Availability: Modify Application Data, DoS: Instability, DoS: Crash, Exit, or Restart

• [Architecture and Design, Implementation] Implement a reliable lock mechanism.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2026-54906: Ruby-based concurrency package does not verify that its calling thread had aquired a write lock. • CVE-2023-5447: Chain: missing lock check (CWE-414) leads to Use-After-Free (CWE-416) • CVE-2004-1056: Product does not properly check if a lock is present, allowing other attackers to access functionality.