CWE-567Unsynchronized Access to Shared Data in a Multithreaded Context

Abstraction: Base · CVEs in our corpus: 12

The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.

Within servlets, shared static variables are not protected from concurrent access, but servlets are multithreaded. This is a typical programming mistake in J2EE applications, since the multithreading is handled by the framework. When a shared variable can be influenced by an attacker, one thread could wind up modifying the variable to contain data that is not valid for a different thread that is also using the data within the variable. Note that this weakness is not unique to servlets.

Last updated: 14 October 2026 20:41 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: partial · 1 mapping(s) from 1 framework(s): ATT&CK 1 (partial)

See the full cumulative-coverage rollup →

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent

Stop it (NIST 800-53 / CSF Protect)

PR.PS-06
SC-4 Information in Shared System Resources

Detect

Catch it (CSF Detect / Respond)

—

Harden

Shrink the surface (DISA STIG)

—

Validate

Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (0)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Control	Title	Family	Why it addresses this CWE
No NIST controls proposed yet.

Top CVEs of this weakness type, ranked by Risk Priority

CVE	Risk	CVSS	EPSS	Published
`CVE-2026-48708`	5.7	7.5	0.0054	2026-06-15
`CVE-2023-44374`	5.2	6.5	0.0067	2023-11-14
`CVE-2025-48908`	4.8	6.7	0.0009	2025-06-06
`CVE-2026-79973`	4.8	6.3	0.0023	2026-09-09
`CVE-2025-14017`	4.5	6.3	0.0011	2026-01-08
`CVE-2026-79962`	4.4	5.3	0.0031	2026-09-09
`CVE-2026-79969`	4.4	5.3	0.0031	2026-09-09
`CVE-2020-25724`	3.8	4.3	0.0063	2021-05-26
`CVE-2026-73631`	3.7	4.3	0.0037	2026-08-15
`CVE-2026-73632`	3.7	4.3	0.0037	2026-08-15
`CVE-2026-46693`	3.1	4.1	0.0010	2026-06-10