Common Weakness Enumeration
CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
802 vulnerabilities reference this CWE, most recent first.
CVE-2026-124622 (GCVE-0-2026-124622)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:45 – Updated: 2026-11-09 12:45 X_Open Source
VLAI
EPSS
VEX
Title
olivier-ls PHP-FTS Storage.php open toctou
Summary
A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 will fix this issue. The name of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. Upgrading the affected component is recommended. The project maintainer explains: "[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the "Code Execution" impact additionally assumes the symlink target is a web-served .php file."
Severity
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/433047 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/433047/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124622 | third-party-advisory |
| https://vuldb.com/submit/1040549 | third-party-advisory |
| https://github.com/olivier-ls/php-fts/issues/3 | issue-tracking |
| https://github.com/olivier-ls/php-fts/commit/0b2f… | patch |
| https://github.com/olivier-ls/php-fts/releases/ta… | patch |
| https://github.com/olivier-ls/php-fts/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| olivier-ls | PHP-FTS |
Affected:
1.1.0
Affected: 1.1.1 Affected: 1.1.2 Affected: 1.1.3 Unaffected: 1.1.4 cpe:2.3:a:olivier-ls:php-fts:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:olivier-ls:php-fts:*:*:*:*:*:*:*:*"
],
"product": "PHP-FTS",
"vendor": "olivier-ls",
"versions": [
{
"status": "affected",
"version": "1.1.0"
},
{
"status": "affected",
"version": "1.1.1"
},
{
"status": "affected",
"version": "1.1.2"
},
{
"status": "affected",
"version": "1.1.3"
},
{
"status": "unaffected",
"version": "1.1.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "summmm (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 will fix this issue. The name of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. Upgrading the affected component is recommended. The project maintainer explains: \"[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the \"Code Execution\" impact additionally assumes the symlink target is a web-served .php file.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "Time-of-check Time-of-use",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:45:23.743Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-433047 | olivier-ls PHP-FTS Storage.php open toctou",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/433047"
},
{
"name": "VDB-433047 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/433047/cti"
},
{
"name": "CVE-2026-124622 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124622"
},
{
"name": "Submit #1040549 | olivier-ls PHP-FTS V1.1.3 Link Following / TOCTOU",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1040549"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/olivier-ls/php-fts/issues/3"
},
{
"tags": [
"patch"
],
"url": "https://github.com/olivier-ls/php-fts/commit/0b2fae333d6b022da7ed4c43e2d41aa03f91dff3"
},
{
"tags": [
"patch"
],
"url": "https://github.com/olivier-ls/php-fts/releases/tag/v1.1.4"
},
{
"tags": [
"product"
],
"url": "https://github.com/olivier-ls/php-fts/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-09T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-09T08:02:33.000Z",
"value": "VulDB entry last update"
}
],
"title": "olivier-ls PHP-FTS Storage.php open toctou",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124622",
"datePublished": "2026-11-09T12:45:23.743Z",
"dateReserved": "2026-11-09T06:57:28.604Z",
"dateUpdated": "2026-11-09T12:45:23.743Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-123804 (GCVE-0-2026-123804)
Vulnerability from cvelistv5 – Published: 2026-11-09 18:53 – Updated: 2026-11-09 18:53
VLAI
EPSS
VEX
Title
SuperTokens Core: A session created concurrently with account unlink survives the unlink
Summary
SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Severity
6.8 (Medium)
CWE
Assigner
GitHub_M
CNA
References
21 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| supertokens | supertokens-core |
Affected:
>= 7.0.0, < 11.0.0
Affected: >= 11.0.0, < 11.0.9 Affected: >= 11.1.0, < 11.1.4 Affected: >= 11.2.0, < 11.2.4 Affected: >= 11.3.0, < 11.3.8 Affected: >= 11.4.0, < 11.4.8 Affected: >= 12.0.0, < 12.0.11 Affected: >= 12.1.0, < 12.1.2 Affected: >= 12.2.0, < 12.2.1 Affected: >= 12.3.0, < 12.3.1 |
{
"containers": {
"cna": {
"affected": [
{
"product": "supertokens-core",
"vendor": "supertokens",
"versions": [
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c 11.0.0"
},
{
"status": "affected",
"version": "\u003e= 11.0.0, \u003c 11.0.9"
},
{
"status": "affected",
"version": "\u003e= 11.1.0, \u003c 11.1.4"
},
{
"status": "affected",
"version": "\u003e= 11.2.0, \u003c 11.2.4"
},
{
"status": "affected",
"version": "\u003e= 11.3.0, \u003c 11.3.8"
},
{
"status": "affected",
"version": "\u003e= 11.4.0, \u003c 11.4.8"
},
{
"status": "affected",
"version": "\u003e= 12.0.0, \u003c 12.0.11"
},
{
"status": "affected",
"version": "\u003e= 12.1.0, \u003c 12.1.2"
},
{
"status": "affected",
"version": "\u003e= 12.2.0, \u003c 12.2.1"
},
{
"status": "affected",
"version": "\u003e= 12.3.0, \u003c 12.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert the session after unlink has enumerated and revoked the existing sessions. A user who controls the linked login method can exploit this race to retain a signed, database-backed, refreshable session as the former primary identity after that method is unlinked; the session persists until expiry or explicit revocation. This issue is fixed in versions 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T18:53:24.985Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-2pc4-vw9j-454c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/supertokens/supertokens-core/security/advisories/GHSA-2pc4-vw9j-454c"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/182b39454ac44649cdef22d87f296a38a0b1a602",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/182b39454ac44649cdef22d87f296a38a0b1a602"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/378e1157dc26232a518d2c360ee60cf93c2fd8a2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/378e1157dc26232a518d2c360ee60cf93c2fd8a2"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/5aec64aca6d765cde491658210e6922e291742fd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/5aec64aca6d765cde491658210e6922e291742fd"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b1c569ed59fffe16c2f657da1754abcae47d2761",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b1c569ed59fffe16c2f657da1754abcae47d2761"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/b44f1e1418206f411e541501c2e5b9b147add0d9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/b44f1e1418206f411e541501c2e5b9b147add0d9"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/bb6d5f8d1b79770e3cc37f214ba94c3e36e9c3b8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/bb6d5f8d1b79770e3cc37f214ba94c3e36e9c3b8"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c0b7f5eda20840f63f6b0f171d22bd49a7a609a1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c0b7f5eda20840f63f6b0f171d22bd49a7a609a1"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c8b48e843b323cd749dcb17b6b81c190e7882a43",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c8b48e843b323cd749dcb17b6b81c190e7882a43"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/c950a01794cf0983ebd62412976cb80756bf5dd0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/c950a01794cf0983ebd62412976cb80756bf5dd0"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/d456dfbc02f2f7d68be7c05d876bdaa086f9a5b5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/d456dfbc02f2f7d68be7c05d876bdaa086f9a5b5"
},
{
"name": "https://github.com/supertokens/supertokens-core/commit/fc273f5157d3e96f147aa42773607d627d3b495f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/commit/fc273f5157d3e96f147aa42773607d627d3b495f"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.0.9"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.1.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.2.4"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.3.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v11.4.8"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.0.11"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.1.2"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.2.1"
},
{
"name": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/supertokens/supertokens-core/releases/tag/v12.3.1"
}
],
"source": {
"advisory": "GHSA-2pc4-vw9j-454c",
"discovery": "UNKNOWN"
},
"title": "SuperTokens Core: A session created concurrently with account unlink survives the unlink"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-123804",
"datePublished": "2026-11-09T18:53:24.985Z",
"dateReserved": "2026-11-06T15:27:56.226Z",
"dateUpdated": "2026-11-09T18:53:24.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121963 (GCVE-0-2026-121963)
Vulnerability from cvelistv5 – Published: 2026-11-04 15:33 – Updated: 2026-11-04 18:20
VLAI
EPSS
VEX
Title
FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close
Summary
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsnd_virtual_channel_write, crashing the client.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:20 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121963",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:20:12.614794Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:20:37.767Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cx9c-q4jc-wm6c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kushalkhemka"
},
{
"lang": "en",
"type": "finder",
"value": "mayank-jangid-moon"
},
{
"lang": "en",
"type": "tool",
"value": "opensec-intelligence"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows malicious RDP servers to trigger freed callback access by closing the channel with queued audio PDUs. Attackers can send a training PDU then close the channel so the playback thread reads the freed callback in rdpsnd_virtual_channel_write, crashing the client."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:33:25.967Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cx9c-q4jc-wm6c)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cx9c-q4jc-wm6c"
},
{
"name": "VulnCheck Advisory: FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-dynamic-rdpsnd-channel-close"
}
],
"title": "FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121963",
"datePublished": "2026-11-04T15:33:25.967Z",
"dateReserved": "2026-11-04T12:48:39.813Z",
"dateUpdated": "2026-11-04T18:20:37.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121961 (GCVE-0-2026-121961)
Vulnerability from cvelistv5 – Published: 2026-11-04 15:33 – Updated: 2026-11-04 18:11
VLAI
EPSS
VEX
Title
FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race
Summary
FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:11 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121961",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:11:32.287751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:11:56.439Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qw7w-hhxq-763c"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kushalkhemka"
},
{
"lang": "en",
"type": "finder",
"value": "mayank-jangid-moon"
},
{
"lang": "en",
"type": "tool",
"value": "opensec-intelligence"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting the drdynvc channel. A malicious target server can repeatedly send CREATE_REQUEST_PDU for an active channel id, racing front DATA handling to free a borrowed context and crash the proxy process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:33:24.537Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-qw7w-hhxq-763c)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qw7w-hhxq-763c"
},
{
"name": "VulnCheck Advisory: FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-drdynvc-tracker-race"
}
],
"title": "FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121961",
"datePublished": "2026-11-04T15:33:24.537Z",
"dateReserved": "2026-11-04T12:48:39.813Z",
"dateUpdated": "2026-11-04T18:11:56.439Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121957 (GCVE-0-2026-121957)
Vulnerability from cvelistv5 – Published: 2026-11-04 15:33 – Updated: 2026-11-04 18:30
VLAI
EPSS
VEX
Title
FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race
Summary
FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:29 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121957",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:29:39.800968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:30:03.893Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xjhw-2r55-m95g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "smaeljaish771"
},
{
"lang": "en",
"type": "sponsor",
"value": "KeenSecurityLab"
}
],
"datePublic": "2026-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client memory by racing the RDPGFX ResetGraphics handler against the planar bitmap decoder. Attackers can send ResetGraphics while concurrently sending compressed bitmaps of 32 bpp or more to trigger heap use-after-free or out-of-bounds read/write on shared planar buffers."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:33:21.652Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xjhw-2r55-m95g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-xjhw-2r55-m95g"
},
{
"name": "VulnCheck Advisory: FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-rdpgfx-resetgraphics-race"
}
],
"title": "FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121957",
"datePublished": "2026-11-04T15:33:21.652Z",
"dateReserved": "2026-11-04T12:46:55.474Z",
"dateUpdated": "2026-11-04T18:30:03.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121628 (GCVE-0-2026-121628)
Vulnerability from cvelistv5 – Published: 2026-11-03 17:13 – Updated: 2026-11-03 22:41
VLAI
EPSS
VEX
Title
Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting
Summary
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 22:38 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
VulnCheck
CNA
References
8 references
| URL | Tags |
|---|---|
| https://github.com/bagisto/bagisto/commit/81cb2a2… | patch |
| https://github.com/bagisto/bagisto/commit/1f57c10… | patch |
| https://github.com/bagisto/bagisto/releases/tag/v2.3.16 | release-notes |
| https://github.com/bagisto/bagisto/releases/tag/v2.4.1 | release-notes |
| https://gist.github.com/Ayxpp/5358d9fff045e94e0dd… | exploit |
| https://github.com/bagisto/bagisto/blob/v2.4.0/pa… | technical-description |
| https://github.com/bagisto/bagisto | product |
| https://www.vulncheck.com/advisories/bagisto-befo… | third-party-advisory |
Impacted products
Date Public
2026-03-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121628",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T22:38:09.792685Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:41:07.843Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:composer/bagisto/bagisto",
"product": "bagisto",
"vendor": "bagisto",
"versions": [
{
"lessThan": "2.3.16",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "2.4.1",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.3.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.4.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "2.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhammad Shariff"
},
{
"lang": "en",
"type": "remediation developer",
"value": "devansh-webkul"
}
],
"datePublic": "2026-03-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:13:54.596Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/bagisto/bagisto/commit/81cb2a2a35b355492f704fd216d679f2145a5650"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/bagisto/bagisto/commit/1f57c10eb9cb61b37de4706ffa439fd26aa7c405"
},
{
"name": "bagisto v2.3.16 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/bagisto/bagisto/releases/tag/v2.3.16"
},
{
"name": "bagisto v2.4.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/bagisto/bagisto/releases/tag/v2.4.1"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/Ayxpp/5358d9fff045e94e0ddb51677ed5d195"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/bagisto/bagisto/blob/v2.4.0/packages/Webkul/CartRule/src/Listeners/Order.php#L30-L95"
},
{
"tags": [
"product"
],
"url": "https://github.com/bagisto/bagisto"
},
{
"name": "VulnCheck Advisory: Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bagisto-before-2.3.16-and-2.4-x-before-2.4.1-race-condition-in-coupon-usage-accounting"
}
],
"title": "Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121628",
"datePublished": "2026-11-03T17:13:54.596Z",
"dateReserved": "2026-11-03T16:57:45.219Z",
"dateUpdated": "2026-11-03T22:41:07.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121408 (GCVE-0-2026-121408)
Vulnerability from cvelistv5 – Published: 2026-11-03 14:28 – Updated: 2026-11-03 18:30
VLAI
EPSS
VEX
Title
FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel
Summary
FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loading_lock. A malicious RDP server can send a control-channel CLOSE_REQUEST while the client announces a USB device, freeing the channel before the announcement thread reads channel->Write and crashing the client.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:22 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121408",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:22:09.826473Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:30:46.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kushalkhemka"
},
{
"lang": "en",
"type": "finder",
"value": "mayank-jangid-moon"
},
{
"lang": "en",
"type": "tool",
"value": "opensec-intelligence"
}
],
"datePublic": "2026-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager\u0027s loading_lock. A malicious RDP server can send a control-channel CLOSE_REQUEST while the client announces a USB device, freeing the channel before the announcement thread reads channel-\u003eWrite and crashing the client."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T14:28:08.803Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-w897-ffhv-5j7g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-w897-ffhv-5j7g"
},
{
"name": "VulnCheck Advisory: FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-use-after-free-via-usb-redirection-control-channel"
}
],
"title": "FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121408",
"datePublished": "2026-11-03T14:28:08.803Z",
"dateReserved": "2026-11-03T12:28:46.507Z",
"dateUpdated": "2026-11-03T18:30:46.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118128 (GCVE-0-2026-118128)
Vulnerability from cvelistv5 – Published: 2026-10-27 22:15 – Updated: 2026-10-28 16:12 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition
Summary
A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-28 15:54 UTC
CWE
- CWE-362 - Race Condition
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/427455 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/427455/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-118128 | third-party-advisory |
| https://vuldb.com/submit/1015057 | third-party-advisory |
| https://github.com/a2aproject/a2a-js/pull/636 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-js/commit/7b87c… | patch |
| https://github.com/a2aproject/a2a-js/releases/tag… | patch |
| https://github.com/a2aproject/a2a-js/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-js |
Affected:
1.0
Affected: 1.1.0 Unaffected: 1.2.0 cpe:2.3:a:a2aproject:a2a-js:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118128",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-28T15:54:30.660593Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T16:12:56.611Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-js:*:*:*:*:*:*:*:*"
],
"modules": [
"Task Status Update Handler"
],
"product": "a2a-js",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "1.0"
},
{
"status": "affected",
"version": "1.1.0"
},
{
"status": "unaffected",
"version": "1.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.4,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T22:15:19.102Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-427455 | a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/427455"
},
{
"name": "VDB-427455 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/427455/cti"
},
{
"name": "CVE-2026-118128 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-118128"
},
{
"name": "Submit #1015057 | a2aproject a2a-js \u2264 1.1.0 CWE-362",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015057"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-js/pull/636"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-js/commit/7b87c9480bfa643f9d2b2eaf06988b3d3a95de25"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-js/releases/tag/v1.2.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-js/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-27T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-27T17:51:51.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-118128",
"datePublished": "2026-10-27T22:15:19.102Z",
"dateReserved": "2026-10-27T16:46:21.253Z",
"dateUpdated": "2026-10-28T16:12:56.611Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118030 (GCVE-0-2026-118030)
Vulnerability from cvelistv5 – Published: 2026-10-29 06:22 – Updated: 2026-11-06 06:24
VLAI
EPSS
VEX
Title
Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins
Summary
A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 14:18 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization
Assigner
redhat
CNA
References
2 references
| URL | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2026-118030 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2562005 | issue-trackingx_refsource_REDHAT |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
Date Public
2026-10-26 13:54
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118030",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T14:18:28.734527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T14:18:44.865Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "keycloak-services",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "unaffected",
"packageName": "keycloak-services",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Muhannad Alsaif (xNadByte) for reporting this issue."
}
],
"datePublic": "2026-10-26T13:54:35.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management services. The issue occurs because the system validates a one-time password and updates its internal counter in two separate steps without proper locking. An attacker with a users password could exploit this timing gap to use a single one-time code to log in multiple times simultaneously."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Concurrent Execution using Shared Resource with Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T06:24:12.242Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-118030"
},
{
"name": "RHBZ#2562005",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562005"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T13:54:35.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-26T13:54:35.000Z",
"value": "Made public."
}
],
"title": "Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-118030",
"datePublished": "2026-10-29T06:22:11.871Z",
"dateReserved": "2026-10-27T14:17:43.932Z",
"dateUpdated": "2026-11-06T06:24:12.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117507 (GCVE-0-2026-117507)
Vulnerability from cvelistv5 – Published: 2026-10-27 15:00 – Updated: 2026-11-02 19:21 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-java TaskManager.saveTaskEvent race condition
Summary
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the patch is 6b8e1e085c35e970ef0048901cd25850e4791ec2. The affected component should be upgraded.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 19:20 UTC
CWE
- CWE-362 - Race Condition
Assigner
VulDB
CNA
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/427074 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/427074/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-117507 | third-party-advisory |
| https://vuldb.com/submit/1015060 | third-party-advisory |
| https://github.com/a2aproject/a2a-java/pull/1045 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-java/commit/6b8… | patch |
| https://github.com/a2aproject/a2a-java/releases/t… | patch |
| https://github.com/a2aproject/a2a-java/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-java |
Affected:
1.2.0.Final
Unaffected: 1.3.0.Final cpe:2.3:a:a2aproject:a2a-java:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-117507",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T19:20:41.350153Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:21:03.858Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-java:*:*:*:*:*:*:*:*"
],
"product": "a2a-java",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "1.2.0.Final"
},
{
"status": "unaffected",
"version": "1.3.0.Final"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the patch is 6b8e1e085c35e970ef0048901cd25850e4791ec2. The affected component should be upgraded."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T15:00:21.118Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-427074 | a2aproject a2a-java TaskManager.saveTaskEvent race condition",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/427074"
},
{
"name": "VDB-427074 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/427074/cti"
},
{
"name": "CVE-2026-117507 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-117507"
},
{
"name": "Submit #1015060 | a2aproject a2a-java \u2264 1.2.0.Final CWE-362",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015060"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-java/pull/1045"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-java/commit/6b8e1e085c35e970ef0048901cd25850e4791ec2"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-java/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-27T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-27T09:52:58.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-java TaskManager.saveTaskEvent race condition",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-117507",
"datePublished": "2026-10-27T15:00:21.118Z",
"dateReserved": "2026-10-27T08:47:34.610Z",
"dateUpdated": "2026-11-02T19:21:03.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Architecture and Design
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
Architecture and Design
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
Implementation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Implementation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Implementation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Implementation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Implementation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Implementation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Architecture and Design
Operation
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.