Cyber Resilience

CWE · MITRE source

CWE-366Race Condition within a Thread

Abstraction: Base · CVEs in our corpus: 18

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 2 mapping(s) from 1 framework(s): CAPEC 2 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • PR.PS-06
  • SA-11 Developer Testing and Evaluation
  • SA-8 Security and Privacy Engineering Principles
  • SA-15 Development Process, Standards, and Tools
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.4.2
  • V15.4.3
  • V17.2.6

NIST 800-53 r5 controls that address this weakness (0)AI-assisted

Control Title Family Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2021-26569 7.79.80.02182021-03-12
CVE-2025-58143 7.29.80.00372025-09-11
CVE-2026-23666 6.17.50.01332026-04-14
CVE-2024-6778 5.87.50.00792024-07-16
CVE-2024-10630 5.77.80.00232025-01-14
CVE-2026-46181 5.57.80.00112026-05-28
CVE-2023-6546 5.47.00.00772023-12-21
CVE-2022-1729 5.27.00.00322022-09-01
CVE-2020-1629 4.85.90.00672020-04-08
CVE-2023-4127 4.75.90.00492023-08-03
CVE-2026-3904 4.66.20.00152026-03-11
CVE-2026-228194.55.90.00222026-01-14
CVE-2026-23684 4.55.90.00162026-02-10
CVE-2015-10067 3.94.60.00542023-01-18
CVE-2023-3218 3.74.40.00472023-06-13
CVE-2023-4732 3.64.70.00182023-10-03
CVE-2024-2032 2.73.10.00292024-06-06