CWEweakness

CWE-833 Deadlock

Official page ↗
Abstraction
Base
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific, Python
CWE version
5.0

Description

The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

Common consequences

• Availability: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Other), DoS: Crash, Exit, or Restart — Each thread of execution will "hang" and prevent tasks from completing. In some cases, CPU consumption may occur if a lock check occurs in a tight loop.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-1999-1476: A bug in some Intel Pentium processors allow DoS (hang) via an invalid "CMPXCHG8B" instruction, causing a deadlock • CVE-2009-2857: OS deadlock • CVE-2009-1961: OS deadlock involving 3 separate functions • CVE-2009-2699: deadlock in library • CVE-2009-4272: deadlock triggered by packets that force collisions in a routing table • CVE-2002-1850: read/write deadlock between web server and script • CVE-2004-0174: web server deadlock involving multiple listening connections • CVE-2009-1388: multiple simultaneous calls to the same function trigger deadlock. • CVE-2006-5158: Chain: other weakness leads to NULL pointer dereference (CWE-476) or deadlock (CWE-833). • CVE-2006-4342: deadlock when an operation is performed on a resource while it is being removed. • CVE-2006-2374: Deadlock in device driver triggered by using file handle of a related device. • CVE-2006-2275: Deadlock when large number of small messages cannot be processed quickly enough. • CVE-2005-3847: OS kernel has deadlock triggered by a signal during a core dump. • CVE-2005-3106: Race condition leads to deadlock. • CVE-2005-2456: Chain: array index error (CWE-129) leads to deadlock (CWE-833)

Related

Attack pattern · CAPEC (1)

  • CAPEC-25 Forced Deadlock attack pattern

Observed example · CVE (15)

  • CVE-2009-4272 A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to… vulnerability
  • CVE-2009-2699 The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as… vulnerability
  • CVE-2009-2857 The kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between the filesystem and… vulnerability
  • CVE-2009-1388 The ptrace_start function in kernel/ptrace.c in the Linux kernel 2.6.18 does not properly handle simultaneous execution of the do_coredump… vulnerability
  • CVE-2009-1961 The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before… vulnerability
  • CVE-2006-4342 The kernel in Red Hat Enterprise Linux 3, when running on SMP systems, allows local users to cause a denial of service (deadlock) by… vulnerability
  • CVE-2006-5158 The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service… vulnerability
  • CVE-2006-2374 The Server Message Block (SMB) driver (MRXSMB.SYS) in Microsoft Windows 2000 SP4, XP SP1 and SP2, and Server 2003 SP1 and earlier allows… vulnerability
  • CVE-2006-2275 Linux SCTP (lksctp) before 2.6.17 allows remote attackers to cause a denial of service (deadlock) via a large number of small messages to a… vulnerability
  • CVE-2005-3847 The handle_stop_signal function in signal.c in Linux kernel 2.6.11 up to other versions before 2.6.13 and 2.6.12.6 allows local users to… vulnerability
  • CVE-2005-3106 Race condition in Linux 2.6, when threads are sharing memory mapping via CLONE_VM (such as linuxthreads and vfork), might allow local users… vulnerability
  • CVE-2005-2456 Array index overflow in the xfrm_sk_policy_insert function in xfrm_user.c in Linux kernel 2.6 allows local users to cause a denial of… vulnerability
  • CVE-2004-0174 Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to… vulnerability
  • CVE-2002-1850 mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory… vulnerability
  • CVE-1999-1476 A bug in Intel Pentium processor (MMX and Overdrive) allows local users to cause a denial of service (hang) in Intel-based operating… vulnerability

Child of · CWE (2)

  • CWE-662 Improper Synchronization weakness
  • CWE-667 Improper Locking weakness

Referenced by CAPEC · weakness (1)

  • CAPEC-25 Forced Deadlock attack pattern

Referenced by CVE · weakness (32)

  • CVE-2026-103558 Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. vulnerability
  • CVE-2026-105390 Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local… vulnerability
  • CVE-2026-70186 Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. vulnerability
  • CVE-2026-105792 Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. vulnerability
  • CVE-2026-77798 Velociraptor contains a deadlock condition that may be triggered by authenticated users. vulnerability
  • CVE-2026-46352 Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. vulnerability
  • CVE-2026-70616 boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server… vulnerability
  • CVE-2026-10647 The USB CDC-NCM device class (subsys/usb/device_next/class/usbd_cdc_ncm.c) ignores the return value of usbd_ep_enqueue() in its ethernet… vulnerability
  • CVE-2026-47334 Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling… vulnerability
  • CVE-2026-44579 Next.js is a React framework for building full-stack web applications. vulnerability
  • CVE-2026-43253 In the Linux kernel, the following vulnerability has been resolved: iommu/amd: move wait_on_sem() out of spinlock With iommu.strict=1, the… vulnerability
  • CVE-2026-33904 Ella Core is a 5G core designed for private networks. vulnerability
  • CVE-2024-48077 NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. vulnerability
  • CVE-2025-10150 Webserver crash caused by scanning on TCP port 80 in Softing Industrial Automation GmbH gateways and switch.This issue affects smartLink… vulnerability
  • CVE-2025-59463 An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers. vulnerability
  • CVE-2025-54796 Copyparty is a portable file server. vulnerability
  • CVE-2025-8312 Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out… vulnerability
  • CVE-2025-36010 IBM Db2 for Linux 12.1.0, 12.1.1, and 12.1.2 could allow an unauthenticated user to cause a denial of service due to executable segments… vulnerability
  • CVE-2025-1713 When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required. vulnerability
  • CVE-2024-29172 Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains a deadlock vulnerability. vulnerability
  • CVE-2025-21313 Windows Security Account Manager (SAM) Denial of Service Vulnerability vulnerability
  • CVE-2024-8447 A security issue was discovered in the LRA Coordinator component of Narayana. vulnerability
  • CVE-2024-47506 A Deadlock vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated,… vulnerability
  • CVE-2024-0639 A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP… vulnerability
  • CVE-2024-0641 A denial of service vulnerability was found in tipc_crypto_key_revoke in net/tipc/crypto.c in the Linux kernel’s TIPC subsystem. vulnerability
  • CVE-2023-42441 Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). vulnerability
  • CVE-2023-0160 A deadlock flaw was found in the Linux kernel’s BPF subsystem. vulnerability
  • CVE-2023-3436 Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream. vulnerability
  • CVE-2023-31084 An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. vulnerability
  • CVE-2022-43767 A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1… vulnerability
Show all 32 ›