Common Weakness Enumeration

CWE-821

Allowed

Incorrect Synchronization

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.

26 vulnerabilities reference this CWE, most recent first.

GHSA-PX97-MH8Q-MM22

Vulnerability from github – Published: 2025-04-07 15:31 – Updated: 2025-04-07 15:31
VLAI
Details

In chainmaker-go (aka ChainMaker) before 2.4.0, when making frequent updates to a node's configuration file and restarting this node, concurrent writes by logger.go to a map are mishandled. Creating other logs simultaneously can lead to a read-write conflict and panic.

Severity
4.0 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-58133"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-821"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-06T03:15:15Z",
    "severity": "MODERATE"
  },
  "details": "In chainmaker-go (aka ChainMaker) before 2.4.0, when making frequent updates to a node\u0027s configuration file and restarting this node, concurrent writes by logger.go to a map are mishandled. Creating other logs simultaneously can lead to a read-write conflict and panic.",
  "id": "GHSA-px97-mh8q-mm22",
  "modified": "2025-04-07T15:31:13Z",
  "published": "2025-04-07T15:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-58133"
    },
    {
      "type": "WEB",
      "url": "https://git.chainmaker.org.cn/chainmaker/issue/-/issues/1228"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-QV89-VXPV-H7VC

Vulnerability from github – Published: 2026-04-10 00:30 – Updated: 2026-04-10 00:30
VLAI
Details

An Incorrect Synchronization vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker with low privileges to cause a complete Denial-of-Service (DoS) of the management plane.

When NETCONF sessions are quickly established and disconnected, a locking issue causes mgd processes to hang in an unusable state. When the maximum number of mgd processes has been reached, no new logins are possible. This leads to the inability to manage the device and requires a power-cycle to recover.

This issue can be monitored by checking for mgd processes in lockf state in the output of 'show system processes extensive':

user@host> show system processes extensive | match mgd root       20   0 501M 4640K lockf   1 0:01 0.00% mgd

If the system still can be accessed (either via the CLI or as root, which might still be possible as last resort as this won't invoke mgd), mgd processes in this state can be killed with 'request system process terminate ' from the CLI or with 'kill -9 ' from the shell. 

This issue affects:

Junos OS:

  • 23.4 versions before 23.4R2-S4,
  • 24.2 versions before 24.2R2-S1,
  • 24.4 versions before 24.4R1-S3, 24.4R2;

This issue does not affect Junos OS versions before 23.4R1;

Junos OS Evolved:

  • 23.4 versions before 23.4R2-S5-EVO,
  • 24.2 versions before 24.2R2-S1-EVO,
  • 24.4 versions before 24.4R1-S3-EVO, 24.4R2-EVO.

This issue does not affect Junos OS Evolved versions before 23.4R1-EVO;

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/RE:M
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-21919"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-821"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-09T22:16:25Z",
    "severity": "HIGH"
  },
  "details": "An Incorrect Synchronization vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker with low privileges to cause a complete Denial-of-Service (DoS) of the management plane.\n\nWhen NETCONF sessions are quickly established and disconnected, a locking issue causes mgd processes to hang in an unusable state. When the maximum number of mgd processes has been reached, no new logins are possible. This leads to the inability to manage the device and requires a power-cycle to recover.\n\nThis issue can be monitored by checking for mgd processes in lockf state in the output of \u0027show system processes extensive\u0027:\n\nuser@host\u003e show system processes extensive | match mgd\n\u003cpid\u003e root  \u00a0 \u00a0 \u00a0  20  \u00a0 0   501M  4640K lockf  \u00a0 1   0:01   0.00% mgd\n\n\nIf the system still can be accessed (either via the CLI or as root, which might still be possible as last resort as this won\u0027t invoke mgd), mgd processes in this state can be killed with \u0027request system process terminate \u003cPID\u003e\u0027 from the CLI or with \u0027kill -9 \u003cPID\u003e\u0027 from the shell.\u00a0\n\n\n\n\nThis issue affects:\n\nJunos OS:\n\n  *  23.4 versions before 23.4R2-S4,\n  *  24.2 versions before 24.2R2-S1,\n  *  24.4 versions before 24.4R1-S3, 24.4R2;\n\n\n\n\nThis issue does not affect Junos OS versions before 23.4R1;\n\n\n\nJunos OS Evolved:\n\n  *  23.4 versions before 23.4R2-S5-EVO,\n  *  24.2 versions before 24.2R2-S1-EVO,\n  *  24.4 versions before 24.4R1-S3-EVO, 24.4R2-EVO.\n\n\n\n\n\n\nThis issue does not affect Junos OS Evolved versions before 23.4R1-EVO;",
  "id": "GHSA-qv89-vxpv-h7vc",
  "modified": "2026-04-10T00:30:29Z",
  "published": "2026-04-10T00:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21919"
    },
    {
      "type": "WEB",
      "url": "https://kb.juniper.net/JSA106019"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-RHCJ-6WXJ-R34P

Vulnerability from github – Published: 2026-05-06 12:30 – Updated: 2026-07-08 15:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix potential race in tcp_v6_syn_recv_sock()

Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late.

After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it.

Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found.

Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion.

This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-43198"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362",
      "CWE-821"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-06T12:16:38Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix potential race in tcp_v6_syn_recv_sock()\n\nCode in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()\nis done too late.\n\nAfter tcp_v4_syn_recv_sock(), the child socket is already visible\nfrom TCP ehash table and other cpus might use it.\n\nSince newinet-\u003epinet6 is still pointing to the listener ipv6_pinfo\nbad things can happen as syzbot found.\n\nMove the problematic code in tcp_v6_mapped_child_init()\nand call this new helper from tcp_v4_syn_recv_sock() before\nthe ehash insertion.\n\nThis allows the removal of one tcp_sync_mss(), since\ntcp_v4_syn_recv_sock() will call it with the correct\ncontext.",
  "id": "GHSA-rhcj-6wxj-r34p",
  "modified": "2026-07-08T15:31:29Z",
  "published": "2026-05-06T12:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43198"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43198.json"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fe89b2f05b854847784f91127319172945c1fadd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/858d2a4f67ff69e645a43487ef7ea7f28f06deae"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7178e2a8027423b2af17ab95df73a749a5b72e5b"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467228"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-43198"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:36349"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:36348"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:36216"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:36073"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:35904"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:35896"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:35894"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:35863"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34443"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:34094"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:33285"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:33215"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:30129"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-RM9G-2VX4-Q4XF

Vulnerability from github – Published: 2024-06-27 21:32 – Updated: 2024-06-27 21:32
VLAI
Details

In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.') in the email address. This allows the creation of multiple accounts with essentially the same email address (e.g., 'attacker123@gmail.com' and 'attacker.123@gmail.com'), leading to incorrect synchronization and potential security issues.

Severity
5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-5755"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-821"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-27T19:15:16Z",
    "severity": "MODERATE"
  },
  "details": "In lunary-ai/lunary versions \u003c=v1.2.11, an attacker can bypass email validation by using a dot character (\u0027.\u0027) in the email address. This allows the creation of multiple accounts with essentially the same email address (e.g., \u0027attacker123@gmail.com\u0027 and \u0027attacker.123@gmail.com\u0027), leading to incorrect synchronization and potential security issues.",
  "id": "GHSA-rm9g-2vx4-q4xf",
  "modified": "2024-06-27T21:32:08Z",
  "published": "2024-06-27T21:32:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5755"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/cf337d37-e602-482b-aa7a-9e34e7f13e1f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-VFPH-FVW4-J4XP

Vulnerability from github – Published: 2024-09-26 09:31 – Updated: 2024-09-26 09:31
VLAI
Details

An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting.

Severity
5.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-4278"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-662",
      "CWE-821"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-26T07:15:02Z",
    "severity": "MODERATE"
  },
  "details": "An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting.",
  "id": "GHSA-vfph-fvw4-j4xp",
  "modified": "2024-09-26T09:31:41Z",
  "published": "2024-09-26T09:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4278"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2466205"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458484"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-XG4Q-HJ2G-49GR

Vulnerability from github – Published: 2024-04-16 00:30 – Updated: 2024-04-16 00:30
VLAI
Details

lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for 'abc@gmail.com' and 'Abc@gmail.com' can both be created, leading to potential impersonation and confusion among users.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-1739"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-821"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-16T00:15:10Z",
    "severity": "HIGH"
  },
  "details": "lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the case of the email characters. For example, accounts for \u0027abc@gmail.com\u0027 and \u0027Abc@gmail.com\u0027 can both be created, leading to potential impersonation and confusion among users.",
  "id": "GHSA-xg4q-hj2g-49gr",
  "modified": "2024-04-16T00:30:33Z",
  "published": "2024-04-16T00:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1739"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lunary-ai/lunary/commit/7351157a21e5acd0162b4528bcae9d65b1c95695"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/2ca70ba5-b6a4-4873-bd55-bc6cef40d300"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list