CWE-567
AllowedUnsynchronized Access to Shared Data in a Multithreaded Context
Abstraction: Base · Status: Draft
The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.
22 vulnerabilities reference this CWE, most recent first.
GHSA-JH4H-2CG6-889H
Vulnerability from github – Published: 2026-01-08 12:30 – Updated: 2026-01-16 18:31When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefore possibly also affect other concurrently setup transfers.
Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.
{
"affected": [],
"aliases": [
"CVE-2025-14017"
],
"database_specific": {
"cwe_ids": [
"CWE-567"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-08T10:15:45Z",
"severity": "MODERATE"
},
"details": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
"id": "GHSA-jh4h-2cg6-889h",
"modified": "2026-01-16T18:31:22Z",
"published": "2026-01-08T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2025-14017.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2025-14017.json"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/01/07/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R2FM-F2P5-C529
Vulnerability from github – Published: 2026-09-09 09:33 – Updated: 2026-09-09 09:33Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Unsynchronized Access to Shared Data in a Multithreaded Context vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
{
"affected": [],
"aliases": [
"CVE-2026-79973"
],
"database_specific": {
"cwe_ids": [
"CWE-567"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-09T09:17:11Z",
"severity": "MODERATE"
},
"details": "Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Unsynchronized Access to Shared Data in a Multithreaded Context vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.",
"id": "GHSA-r2fm-f2p5-c529",
"modified": "2026-09-09T09:33:00Z",
"published": "2026-09-09T09:33:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79973"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Remove the use of static variables used between servlets. If this cannot be avoided, use synchronized access for these variables.
CAPEC-25: Forced Deadlock
The adversary triggers and exploits a deadlock condition in the target software to cause a denial of service. A deadlock can occur when two or more competing actions are waiting for each other to finish, and thus neither ever does. Deadlock conditions can be difficult to detect.