CWEweakness
CWE-821 Incorrect Synchronization
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.
Common consequences
• Integrity, Confidentiality, Other: Modify Application Data, Read Application Data, Alter Execution Logic, Unexpected State — If access to a shared resource is not correctly synchronized, then the resource may not be in a state that is expected by the product. This might lead to unexpected or insecure behaviors, especially if an attacker can influence the shared resource.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Related
Child of · CWE (1)
- CWE-662 Improper Synchronization weakness
Referenced by CVE · weakness (14)
- CVE-2026-77584 Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. vulnerability
- CVE-2026-56132 In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is… vulnerability
- CVE-2026-43198 In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in… vulnerability
- CVE-2026-21919 An Incorrect Synchronization vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a… vulnerability
- CVE-2024-58131 FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a malicious node (that… vulnerability
- CVE-2024-58132 In chainmaker-go (aka ChainMaker) before 2.3.6, multiple updates to a single node's configuration can cause other normal nodes to perform… vulnerability
- CVE-2024-58133 In chainmaker-go (aka ChainMaker) before 2.4.0, when making frequent updates to a node's configuration file and restarting this node,… vulnerability
- CVE-2024-6657 A denial of service may be caused to a single peripheral device in a BLE network when multiple central devices continuously connect and… vulnerability
- CVE-2024-4278 An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior… vulnerability
- CVE-2024-5755 In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.') in the email address. vulnerability
- CVE-2024-1739 lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. vulnerability
- CVE-2024-1902 lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper… vulnerability
- CVE-2023-5088 A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead… vulnerability
- CVE-2022-1931 Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3. vulnerability