CWE-362

{
  "affected": [],
  "aliases": [
    "CVE-2026-28545"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-05T08:15:59Z",
    "severity": "MODERATE"
  },
  "details": "Race condition vulnerability in the printing module.\u00a0Impact: Successful exploitation of this vulnerability may affect availability.",
  "id": "GHSA-44j2-jfxj-37px",
  "modified": "2026-03-06T00:31:31Z",
  "published": "2026-03-05T09:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28545"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/en/support/bulletin/2026/3"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/en/support/bulletinlaptops/2026/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-49579"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-26T07:01:33Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: Fix data-races around sysctl_fib_multipath_hash_policy.\n\nWhile reading sysctl_fib_multipath_hash_policy, it can be changed\nconcurrently.  Thus, we need to add READ_ONCE() to its readers.",
  "id": "GHSA-44mr-5383-8m35",
  "modified": "2025-03-10T21:31:10Z",
  "published": "2025-03-10T21:31:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49579"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/21fb844bc1dc1461f5038d655aa1a14f39e13049"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7998c12a08c97cc26660532c9f90a34bd7d8da5a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/918ee6592ab9a2ff5316d06cfd4aaef60ccabec6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-11761"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-08T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox \u003c 70, Thunderbird \u003c 68.2, and Firefox ESR \u003c 68.2.",
  "id": "GHSA-44qm-5fqq-5hw7",
  "modified": "2023-02-01T15:30:22Z",
  "published": "2022-05-24T17:05:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11761"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1561502"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202003-10"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4335-1"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2019-33"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2019-34"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2019-35"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-49803"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-14T17:16:56Z",
    "severity": "HIGH"
  },
  "details": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.",
  "id": "GHSA-44rq-rg9q-573c",
  "modified": "2026-07-14T18:32:03Z",
  "published": "2026-07-14T18:32:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49803"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49803"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-5893"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-08T22:16:29Z",
    "severity": "MODERATE"
  },
  "details": "Race in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)",
  "id": "GHSA-44vf-4x73-jv4x",
  "modified": "2026-04-13T21:30:38Z",
  "published": "2026-04-09T00:32:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5893"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/487768771"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-49126"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362",
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T02:04:39Z",
    "severity": "HIGH"
  },
  "details": "Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability",
  "id": "GHSA-453g-5mrh-qccr",
  "modified": "2024-12-12T03:33:05Z",
  "published": "2024-12-12T03:33:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49126"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49126"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/OliveTin/OliveTin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260301235225-f044d90d5525c"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28789"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362",
      "CWE-400",
      "CWE-662"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-02T21:41:36Z",
    "nvd_published_at": "2026-03-05T20:16:16Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nAn unauthenticated denial-of-service vulnerability exists in OliveTin\u2019s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal\n  error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled.\n\n\n### Details\nThe OAuth2 handler stores per-login state in a shared map without synchronization:\n\n  - service/internal/auth/otoauth2/restapi_auth_oauth2.go:24\n    registeredStates map[string]*oauth2State\n  - Unlocked write in login handler: .../restapi_auth_oauth2.go:141\n  - Unlocked read in callback check: .../restapi_auth_oauth2.go:174\n  - Unlocked writes in callback flow: .../restapi_auth_oauth2.go:284-285\n  - Unlocked read in auth chain check: .../restapi_auth_oauth2.go:376\n\n  These paths are network reachable via publicly registered routes:\n```bash\n  - service/internal/httpservers/frontend.go:71 \u2192 /oauth/login\n  - service/internal/httpservers/frontend.go:72 \u2192 /oauth/callback\n```\n  Because Go HTTP handlers run concurrently, high parallel traffic to /oauth/login causes concurrent map access and runtime panic.\n\n  Tested on:\n\n  - Container image: ghcr.io/olivetin/olivetin:3000.10.0\n  - Source also contains same pattern at commit/tag eb42029b5d0c0633551621288180dd4566b913f7 (3000.10.1)\n\n\n### PoC\n1. Start OliveTin with OAuth2 provider configured (example github), exposing port 1337.\n  2. Confirm baseline:\n```bash\n  curl -i http://127.0.0.1:1337/readyz\n  curl -i \"http://127.0.0.1:1337/oauth/login?provider=github\"\n```\n  Expected: 200 for /readyz, 302 for /oauth/login.\n\n  3. Run concurrency PoC:\n```bash\n  python3 /OliveTin/tools/poc_oauth2_state_map_race_dos.py \\\n    --base-url http://127.0.0.1:1337 \\\n    --provider github \\\n    --workers 80 \\\n    --requests 120000 \\\n    --health-failures 3\n```\n  4. Verify crash:\n\n  docker inspect olivetin-dos --format \u0027status={{.State.Status}} exit={{.State.ExitCode}}\u0027\n  docker logs olivetin-dos 2\u003e\u00261 | grep -E \"fatal error: concurrent map|concurrent map writes|restapi_auth_oauth2.go\"\n\n  Observed result:\n\n  - Process exited with code 2\n  - Logs include:\n      - fatal error: concurrent map writes\n      - .../internal/auth/otoauth2/restapi_auth_oauth2.go:141 in HandleOAuthLogin\n\n\n\n### Impact\n- Vulnerability type: Race condition (CWE-362) leading to DoS.\n  - Attacker requirements: network access only; no authentication required for exploit path.\n  - Impacted deployments: OliveTin instances with OAuth2 enabled and reachable over network.\n  - Security impact: remote unauthenticated attacker can repeatedly crash OliveTin, causing availability loss until restart/recovery.\n \n[poc_oauth2_state_map_race_dos.py](https://github.com/user-attachments/files/25577901/poc_oauth2_state_map_race_dos.py)",
  "id": "GHSA-45m3-398w-m2m9",
  "modified": "2026-03-05T22:49:34Z",
  "published": "2026-03-02T21:41:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-45m3-398w-m2m9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28789"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/commit/f044d90d5525c4c8e3f421b32ed7eff771c22d36"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OliveTin/OliveTin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handling"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-0270"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-04-22T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "On PTX Series and QFX10k Series devices with the \"inline-jflow\" feature enabled, a use after free weakness in the Packet Forwarding Engine (PFE) microkernel architecture of Juniper Networks Junos OS may allow an attacker to cause a Denial of Service (DoS) condition whereby one or more Flexible PIC Concentrators (FPCs) may restart. As this is a race condition situation this issue become more likely to be hit when network instability occurs, such as but not limited to BGP/IGP reconvergences, and/or further likely to occur when more active \"traffic flows\" are occurring through the device. When this issue occurs, it will cause one or more FPCs to restart unexpectedly. During FPC restarts core files will be generated. While the core file is generated traffic will be disrupted. Sustained receipt of large traffic flows and reconvergence-like situations may sustain the Denial of Service (DoS) situation. This issue affects: Juniper Networks Junos OS: 18.1 version 18.1R2 and later versions prior to 18.1R3-S10 on PTX Series, QFX10K Series.",
  "id": "GHSA-4633-w3xc-3953",
  "modified": "2022-05-24T17:48:16Z",
  "published": "2022-05-24T17:48:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0270"
    },
    {
      "type": "WEB",
      "url": "https://kb.juniper.net/JSA11161"
    },
    {
      "type": "WEB",
      "url": "https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/inline-flow-monitoring-ptx.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-24377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-21T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the \u0027Import Settings\u0027 feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.",
  "id": "GHSA-4639-xx39-q537",
  "modified": "2022-05-24T19:05:47Z",
  "published": "2022-05-24T19:05:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24377"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/85c0a564-2e56-413d-bc3a-1039343207e4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.security:spring-security-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.security:spring-security-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2011-2731"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-13T17:46:37Z",
    "nvd_published_at": "2012-12-05T17:55:00Z",
    "severity": "MODERATE"
  },
  "details": "Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.",
  "id": "GHSA-4644-hg35-55m9",
  "modified": "2022-07-13T17:46:37Z",
  "published": "2022-05-17T04:59:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2731"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spring-projects/spring-security"
    },
    {
      "type": "WEB",
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677814"
    },
    {
      "type": "WEB",
      "url": "http://support.springsource.com/security/cve-2011-2731"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security"
}