Common Weakness Enumeration

CWE-362

Allowed-with-Review

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Abstraction: Class · Status: Draft

API response cwe.mitre.org

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

2900 vulnerabilities reference this CWE, most recent first.

GHSA-335H-X4PF-HPC2

Vulnerability from github – Published: 2022-12-15 21:30 – Updated: 2022-12-20 18:30
VLAI
Details

A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.

Severity
7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-46689"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-12-15T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.2 and iPadOS 16.2, watchOS 9.2. An app may be able to execute arbitrary code with kernel privileges.",
  "id": "GHSA-335h-x4pf-hpc2",
  "modified": "2022-12-20T18:30:19Z",
  "published": "2022-12-15T21:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46689"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213530"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213531"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213532"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213533"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213534"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213535"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/HT213536"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Dec/20"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Dec/21"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Dec/23"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Dec/24"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Dec/25"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Dec/26"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2022/Dec/27"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-336G-5Q96-RPM6

Vulnerability from github – Published: 2025-03-19 06:31 – Updated: 2025-03-19 06:31
VLAI
Details

Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication attempts, but instead allows hundreds of failed authentication attempts, because concurrent attempts are mishandled.

Severity
3.5 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-30235"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-19T06:15:16Z",
    "severity": "LOW"
  },
  "details": "Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication attempts, but instead allows hundreds of failed authentication attempts, because concurrent attempts are mishandled.",
  "id": "GHSA-336g-5q96-rpm6",
  "modified": "2025-03-19T06:31:54Z",
  "published": "2025-03-19T06:31:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30235"
    },
    {
      "type": "WEB",
      "url": "https://reserge.org/probabilistically-breaking-securenvoy-totp"
    },
    {
      "type": "WEB",
      "url": "https://securenvoy.com/wp-content/uploads/2025/03/Release-Notes-9.4.515.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-338V-3958-8V8R

Vulnerability from github – Published: 2020-06-10 20:54 – Updated: 2021-08-30 13:39
VLAI
Summary
Information disclosure in JBoss Weld
Details

Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.

Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jboss.weld:weld-core-bom"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2014-8122"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-10T20:53:46Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.",
  "id": "GHSA-338v-3958-8v8r",
  "modified": "2021-08-30T13:39:36Z",
  "published": "2020-06-10T20:54:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8122"
    },
    {
      "type": "WEB",
      "url": "https://github.com/weld/core/commit/29fd1107fd30579ad9bb23fae4dc3ba464205745"
    },
    {
      "type": "WEB",
      "url": "https://github.com/weld/core/commit/6808b11cd6d97c71a2eed754ed4f955acd789086"
    },
    {
      "type": "WEB",
      "url": "https://github.com/weld/core/commit/8e413202fa1af08c09c580f444e4fd16874f9c65"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/100892"
    },
    {
      "type": "WEB",
      "url": "https://github.com/victims/victims-cve-db/blob/master/database/java/2014/8122.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/weld/core"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0215.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0216.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0217.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0218.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0675.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0773.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0850.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0851.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2015-0920.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/74252"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1031741"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Information disclosure in JBoss Weld"
}

GHSA-33H2-RXGW-84JC

Vulnerability from github – Published: 2023-09-04 03:30 – Updated: 2024-04-04 07:24
VLAI
Details

In ims service, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07937105; Issue ID: ALPS07937105.

Severity
6.4 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-20827"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1298",
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-04T03:15:09Z",
    "severity": "MODERATE"
  },
  "details": "In ims service, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07937105; Issue ID: ALPS07937105.",
  "id": "GHSA-33h2-rxgw-84jc",
  "modified": "2024-04-04T07:24:27Z",
  "published": "2023-09-04T03:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20827"
    },
    {
      "type": "WEB",
      "url": "https://corp.mediatek.com/product-security-bulletin/September-2023"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-33M9-PM4R-23HX

Vulnerability from github – Published: 2022-05-17 05:45 – Updated: 2022-05-17 05:45
VLAI
Details

Race condition in Apple iOS 4.0 through 4.1 for iPhone 3G and later allows physically proximate attackers to bypass the passcode lock by making a call from the Emergency Call screen, then quickly pressing the Sleep/Wake button.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2010-4012"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-12-08T20:00:00Z",
    "severity": "MODERATE"
  },
  "details": "Race condition in Apple iOS 4.0 through 4.1 for iPhone 3G and later allows physically proximate attackers to bypass the passcode lock by making a call from the Emergency Call screen, then quickly pressing the Sleep/Wake button.",
  "id": "GHSA-33m9-pm4r-23hx",
  "modified": "2022-05-17T05:45:52Z",
  "published": "2022-05-17T05:45:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4012"
    },
    {
      "type": "WEB",
      "url": "http://support.apple.com/kb/HT4456"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-33RW-2CG2-2MPC

Vulnerability from github – Published: 2024-12-04 15:31 – Updated: 2025-11-04 00:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

mm: revert "mm: shmem: fix data-race in shmem_getattr()"

Revert d949d1d14fa2 ("mm: shmem: fix data-race in shmem_getattr()") as suggested by Chuck [1]. It is causing deadlocks when accessing tmpfs over NFS.

As Hugh commented, "added just to silence a syzbot sanitizer splat: added where there has never been any practical problem".

Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-53136"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-04T15:15:13Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: revert \"mm: shmem: fix data-race in shmem_getattr()\"\n\nRevert d949d1d14fa2 (\"mm: shmem: fix data-race in shmem_getattr()\") as\nsuggested by Chuck [1].  It is causing deadlocks when accessing tmpfs over\nNFS.\n\nAs Hugh commented, \"added just to silence a syzbot sanitizer splat: added\nwhere there has never been any practical problem\".",
  "id": "GHSA-33rw-2cg2-2mpc",
  "modified": "2025-11-04T00:32:09Z",
  "published": "2024-12-04T15:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53136"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/36b537e8f302f670c7cf35d88a3a294443e32d52"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/57cc8d253099d1b8627f0fb487ee011d9158ccc9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5874c1150e77296565ad6e495ef41fbf87570d14"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/64e67e8694252c1bf01b802ee911be3fee62c36b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/901dc2ad7c3789fa87dc3956f6697c5d62d5cf7e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a3c65022d89d5baa2cea8e87a6de983ea305f14c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d1aa0c04294e29883d65eac6c2f72fe95cc7c049"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d3f9d88c2c03b2646ace336236adca19f7697bd3"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-33X4-8657-2C2G

Vulnerability from github – Published: 2025-03-12 00:31 – Updated: 2025-03-12 00:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

raw: Fix a data-race around sysctl_raw_l3mdev_accept.

While reading sysctl_raw_l3mdev_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.

Severity
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-49631"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:38Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nraw: Fix a data-race around sysctl_raw_l3mdev_accept.\n\nWhile reading sysctl_raw_l3mdev_accept, it can be changed concurrently.\nThus, we need to add READ_ONCE() to its reader.",
  "id": "GHSA-33x4-8657-2c2g",
  "modified": "2025-03-12T00:31:47Z",
  "published": "2025-03-12T00:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49631"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/038a87b3e460d2ee579c8b1bd3890d816d6687b1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1dace014928e6e385363032d359a04dee9158af0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/46e9c46203fd4676720ddca0fef7eff26826648e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ab5adca2e17d6595f3fc0e25ccb6bcbe2e01ca4f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cc9540ba5b3652c473af7e54892a48cdced87983"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-3422-45QX-4M3X

Vulnerability from github – Published: 2022-05-17 03:13 – Updated: 2022-05-17 03:13
VLAI
Details

Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (NULL pointer free and module crash) by triggering intermittent connectivity with many IPv6 CPE devices, aka Bug ID CSCug47366.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2015-4199"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-06-27T10:59:00Z",
    "severity": "HIGH"
  },
  "details": "Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (NULL pointer free and module crash) by triggering intermittent connectivity with many IPv6 CPE devices, aka Bug ID CSCug47366.",
  "id": "GHSA-3422-45qx-4m3x",
  "modified": "2022-05-17T03:13:42Z",
  "published": "2022-05-17T03:13:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-4199"
    },
    {
      "type": "WEB",
      "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=39423"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/75335"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1032692"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-344P-V638-Q9GC

Vulnerability from github – Published: 2022-10-21 12:00 – Updated: 2022-10-25 12:00
VLAI
Details

A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the identifier assigned to this vulnerability.

Severity
7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-3635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119",
      "CWE-362",
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-21T11:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function tst_timer of the file drivers/atm/idt77252.c of the component IPsec. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. VDB-211934 is the identifier assigned to this vulnerability.",
  "id": "GHSA-344p-v638-q9gc",
  "modified": "2022-10-25T12:00:15Z",
  "published": "2022-10-21T12:00:15Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3635"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next.git/commit/?id=3f4093e2bf4673f218c0bf17d8362337c400e77b"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.211934"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-345P-7CG4-V4C7

Vulnerability from github – Published: 2026-02-04 20:04 – Updated: 2026-02-09 14:52
VLAI
Summary
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Details

Summary

Cross-client data leak via two distinct issues: (1) reusing a single StreamableHTTPServerTransport across multiple client requests, and (2) reusing a single McpServer/Server instance across multiple transports. Both are most common in stateless deployments.

Impact

This advisory covers two related but distinct vulnerabilities. A deployment may be affected by one or both.

Issue 1: Transport re-use

What happens: When a single StreamableHTTPServerTransport instance handles multiple client requests, JSON-RPC message ID collisions cause responses to be routed to the wrong client's HTTP connection. The transport maintains an internal requestId → stream mapping, and since MCP client SDKs generate message IDs using an incrementing counter starting at 0, two clients produce identical IDs. The second client's request overwrites the first client's mapping entry, routing the response to the wrong HTTP stream.

What is affected: All request types — tools/call, resources/read, prompts/get, etc. No server-initiated features are required to trigger this.

Conditions: - A single StreamableHTTPServerTransport instance is reused across multiple client requests (most common in stateless mode without sessionIdGenerator) - Two or more clients send requests concurrently - Clients generate overlapping JSON-RPC message IDs (the SDK's default client uses an incrementing counter starting at 0)

Issue 2: Server/Protocol re-use

What happens: When a single McpServer (or Server) instance is connect()ed to multiple transports (one per client), the Protocol's internal this._transport reference is silently overwritten. The final response to a request is routed correctly (the Protocol captures the transport reference at request time), but any server-to-client messages sent during request handling use the shared this._transport reference, which may point to a different client's transport.

What is affected: This depends on what features your server uses:

  • Final responses (the return value from a tool/resource/prompt handler): Affected in most cases. The Protocol captures this._transport at request-handling time, not the transport that delivered the request. This means:
    • If a request is already in-flight when a second connect() occurs (i.e., the request arrived before the transport was overwritten), the captured reference is correct and the response routes properly.
    • If a request arrives on the old transport after a second connect() has overwritten this._transport, the captured reference points to the new transport, and the response is mis-routed. The requesting client will time out.
  • Progress notifications sent during tool execution via sendNotification: Affected. These are dispatched through this._transport. When the transport has been overwritten and message IDs collide on the new transport, notifications are routed to the wrong client's HTTP stream.
  • Sampling (createMessage) and elicitation requests sent during tool execution via sendRequest: Affected. Same mechanism — the request is sent to the wrong client.
  • Spontaneous server-initiated notifications (outside any request handler): Affected. These are sent to whichever client's transport was most recently connected.

Conditions: - A single McpServer/Server instance is connect()ed to multiple transports across requests or sessions - Two or more clients connect concurrently - For in-request notifications/requests: message ID collision on the other transport is required for silent data leaking (the SDK's default client uses an incrementing counter starting at 0). Without collision, the transport will throw an error rather than misroute. - For spontaneous notifications: no collision needed, messages are always sent to the last-connected client's transport

How to tell if you're affected

  • You use sessionIdGenerator (stateful mode) with a new McpServer per session → not affected by either issue. Each session has its own transport and server instance.
  • You use sessionIdGenerator but share a single McpServer across sessions → not affected by Issue 1 (transport re-use), but affected by Issue 2 (server re-use) if your tools send progress notifications, sampling, or elicitation during execution.
  • You are in stateless mode and reuse both a transport and a server across requests → affected by both issues; all request types can leak.
  • You are in stateless mode and create a new transport per request, but reuse the server → affected by Issue 2 only; safe if your tools only return results without sending progress notifications, sampling, or elicitation during execution.
  • You create a new server + transport per request → not affected.
  • Single-client environments (e.g., local development with one IDE) → not affected.

Patches

The fix (v1.26.0) adds runtime guards that turn silent data misrouting into immediate, actionable errors:

  1. Protocol.connect() now throws if the protocol is already connected to a transport, preventing silent transport overwriting (addresses Issue 2)
  2. Stateless StreamableHTTPServerTransport.handleRequest() now throws if called more than once, enforcing one-request-per-transport in stateless mode (addresses Issue 1)
  3. In-flight request handler abort controllers are cleaned up on close(), and sendNotification/sendRequest in handler extras check the abort signal before sending, preventing messages from leaking after a transport is replaced

Servers that were incorrectly reusing instances will now receive a clear error message directing them to create separate instances per connection.

Workarounds

If you cannot upgrade immediately, ensure your server creates fresh McpServer and transport instances for each request (stateless) or session (stateful):

// Stateless mode: create new server + transport per request
app.post('/mcp', async (req, res) => {
  const server = new McpServer({ name: 'my-server', version: '1.0.0' });
  // ... register tools, resources, etc.
  const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
  await server.connect(transport);
  await transport.handleRequest(req, res);
});

// Stateful mode: create new server + transport per session
const sessions = new Map();
app.post('/mcp', async (req, res) => {
  const sessionId = req.headers['mcp-session-id'];
  if (sessions.has(sessionId)) {
    await sessions.get(sessionId).transport.handleRequest(req, res);
  } else {
    const server = new McpServer({ name: 'my-server', version: '1.0.0' });
    // ... register tools, resources, etc.
    const transport = new StreamableHTTPServerTransport({
      sessionIdGenerator: () => randomUUID()
    });
    await server.connect(transport);
    sessions.set(transport.sessionId, { server, transport });
    await transport.handleRequest(req, res);
  }
});
Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.25.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@modelcontextprotocol/sdk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.10.0"
            },
            {
              "fixed": "1.26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25536"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-04T20:04:16Z",
    "nvd_published_at": "2026-02-04T22:15:59Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nCross-client data leak via two distinct issues: (1) reusing a single `StreamableHTTPServerTransport` across multiple client requests, and (2) reusing a single `McpServer`/`Server` instance across multiple transports. Both are most common in stateless deployments.\n\n### Impact\n\nThis advisory covers two related but distinct vulnerabilities. A deployment may be affected by one or both.\n\n#### Issue 1: Transport re-use\n\n**What happens:** When a single `StreamableHTTPServerTransport` instance handles multiple client requests, JSON-RPC message ID collisions cause responses to be routed to the wrong client\u0027s HTTP connection. The transport maintains an internal `requestId \u2192 stream` mapping, and since MCP client SDKs generate message IDs using an incrementing counter starting at 0, two clients produce identical IDs. The second client\u0027s request overwrites the first client\u0027s mapping entry, routing the response to the wrong HTTP stream.\n\n**What is affected:** All request types \u2014 `tools/call`, `resources/read`, `prompts/get`, etc. No server-initiated features are required to trigger this.\n\n**Conditions:**\n- A single `StreamableHTTPServerTransport` instance is reused across multiple client requests (most common in stateless mode without `sessionIdGenerator`)\n- Two or more clients send requests concurrently\n- Clients generate overlapping JSON-RPC message IDs (the SDK\u0027s default client uses an incrementing counter starting at 0)\n\n#### Issue 2: Server/Protocol re-use\n\n**What happens:** When a single `McpServer` (or `Server`) instance is `connect()`ed to multiple transports (one per client), the Protocol\u0027s internal `this._transport` reference is silently overwritten. The final response to a request is routed correctly (the Protocol captures the transport reference at request time), but any **server-to-client messages sent during request handling** use the shared `this._transport` reference, which may point to a different client\u0027s transport.\n\n**What is affected:** This depends on what features your server uses:\n\n  - **Final responses** (the return value from a tool/resource/prompt handler): Affected in most cases. The Protocol captures this._transport at [request-handling time](https://github.com/modelcontextprotocol/typescript-sdk/blob/main/packages/core/src/shared/protocol.ts#L760), not the transport that delivered the request. This means:\n    - If a request is already in-flight when a second connect() occurs (i.e., the request\n   arrived before the transport was overwritten), the captured reference is correct and\n  the response routes properly.\n    - If a request arrives on the old transport after a second connect() has overwritten\n  this._transport, the captured reference points to the new transport, and the response\n  is mis-routed. The requesting client will time out.\n- **Progress notifications** sent during tool execution via `sendNotification`: **Affected.** These are dispatched through `this._transport`. When the transport has been overwritten and message IDs collide on the new transport, notifications are routed to the wrong client\u0027s HTTP stream.\n- **Sampling** (`createMessage`) and **elicitation** requests sent during tool execution via `sendRequest`: **Affected.** Same mechanism \u2014 the request is sent to the wrong client.\n- **Spontaneous server-initiated notifications** (outside any request handler): **Affected.** These are sent to whichever client\u0027s transport was most recently connected.\n\n**Conditions:**\n- A single `McpServer`/`Server` instance is `connect()`ed to multiple transports across requests or sessions\n- Two or more clients connect concurrently\n- For in-request notifications/requests: message ID collision on the other transport is required for silent data leaking (the SDK\u0027s default client uses an incrementing counter starting at 0). Without collision, the transport will throw an error rather than misroute.\n- For spontaneous notifications: no collision needed, messages are always sent to the last-connected client\u0027s transport\n\n#### How to tell if you\u0027re affected\n\n- **You use `sessionIdGenerator` (stateful mode) with a new `McpServer` per session** \u2192 not affected by either issue. Each session has its own transport and server instance.\n- **You use `sessionIdGenerator` but share a single `McpServer` across sessions** \u2192 not affected by Issue 1 (transport re-use), but affected by Issue 2 (server re-use) if your tools send progress notifications, sampling, or elicitation during execution.\n- **You are in stateless mode and reuse both a transport and a server across requests** \u2192 affected by both issues; all request types can leak.\n- **You are in stateless mode and create a new transport per request, but reuse the server** \u2192 affected by Issue 2 only; safe if your tools only return results without sending progress notifications, sampling, or elicitation during execution.\n- **You create a new server + transport per request** \u2192 not affected.\n- **Single-client environments** (e.g., local development with one IDE) \u2192 not affected.\n\n### Patches\n\nThe fix (v1.26.0) adds runtime guards that turn silent data misrouting into immediate, actionable errors:\n\n1. `Protocol.connect()` now throws if the protocol is already connected to a transport, preventing silent transport overwriting (addresses Issue 2)\n2. Stateless `StreamableHTTPServerTransport.handleRequest()` now throws if called more than once, enforcing one-request-per-transport in stateless mode (addresses Issue 1)\n3. In-flight request handler abort controllers are cleaned up on `close()`, and `sendNotification`/`sendRequest` in handler extras check the abort signal before sending, preventing messages from leaking after a transport is replaced\n\nServers that were incorrectly reusing instances will now receive a clear error message directing them to create separate instances per connection.\n\n### Workarounds\n\nIf you cannot upgrade immediately, ensure your server creates fresh `McpServer` and transport instances for each request (stateless) or session (stateful):\n\n```typescript\n// Stateless mode: create new server + transport per request\napp.post(\u0027/mcp\u0027, async (req, res) =\u003e {\n  const server = new McpServer({ name: \u0027my-server\u0027, version: \u00271.0.0\u0027 });\n  // ... register tools, resources, etc.\n  const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });\n  await server.connect(transport);\n  await transport.handleRequest(req, res);\n});\n\n// Stateful mode: create new server + transport per session\nconst sessions = new Map();\napp.post(\u0027/mcp\u0027, async (req, res) =\u003e {\n  const sessionId = req.headers[\u0027mcp-session-id\u0027];\n  if (sessions.has(sessionId)) {\n    await sessions.get(sessionId).transport.handleRequest(req, res);\n  } else {\n    const server = new McpServer({ name: \u0027my-server\u0027, version: \u00271.0.0\u0027 });\n    // ... register tools, resources, etc.\n    const transport = new StreamableHTTPServerTransport({\n      sessionIdGenerator: () =\u003e randomUUID()\n    });\n    await server.connect(transport);\n    sessions.set(transport.sessionId, { server, transport });\n    await transport.handleRequest(req, res);\n  }\n});\n```",
  "id": "GHSA-345p-7cg4-v4c7",
  "modified": "2026-02-09T14:52:39Z",
  "published": "2026-02-04T20:04:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-345p-7cg4-v4c7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25536"
    },
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/issues/204"
    },
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk/issues/243"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/modelcontextprotocol/typescript-sdk"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse"
}
Mitigation
Architecture and Design

In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.

Mitigation
Architecture and Design

Use thread-safe capabilities such as the data access abstraction in Spring.

Mitigation
Architecture and Design
  • Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
  • Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
Implementation

When using multithreading and operating on shared variables, only use thread-safe functions.

Mitigation
Implementation

Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.

Mitigation
Implementation

Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.

Mitigation
Implementation

Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.

Mitigation
Implementation

Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.

Mitigation
Implementation

Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.

Mitigation MIT-17
Architecture and Design Operation

Strategy: Environment Hardening

Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

CAPEC-26: Leveraging Race Conditions

The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.

CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions

This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.

← Back to the CWE list