CWEweakness
CWE-820 Missing Synchronization
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
Common consequences
• Integrity, Confidentiality, Other: Modify Application Data, Read Application Data, Alter Execution Logic — If access to a shared resource is not synchronized, then the resource may not be in a state that is expected by the product. This might lead to unexpected or insecure behaviors, especially if an attacker can influence the shared resource.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Related
Child of · CWE (1)
- CWE-662 Improper Synchronization weakness
Referenced by CVE · weakness (16)
- CVE-2026-50013 Hoverfly is an open source API simulation tool. vulnerability
- CVE-2026-70637 LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by… vulnerability
- CVE-2026-57029 A Missing Synchronization vulnerability in the flow collector handler of Juniper Networks Junos OS Evolved on QFX Series allows an… vulnerability
- CVE-2026-53153 In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent… vulnerability
- CVE-2026-53277 In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock for page table walks in fault injection… vulnerability
- CVE-2026-44318 free5GC is an open-source implementation of the 5G core network. vulnerability
- CVE-2026-22163 Requires malware code to misuse the DDK kernel module IOCTL interface. vulnerability
- CVE-2022-50238 The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. vulnerability
- CVE-2025-49751 Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network. vulnerability
- CVE-2025-47999 Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network. vulnerability
- CVE-2025-47154 LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and… vulnerability
- CVE-2025-1445 A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open… vulnerability
- CVE-2024-49114 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability vulnerability
- CVE-2024-30387 A Missing Synchronization vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on ACX5448 and ACX710 allows an… vulnerability
- CVE-2023-45084 An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to… vulnerability
- CVE-2023-2801 Grafana is an open-source platform for monitoring and observability. vulnerability