recorded together · two weakness classes
Race Conditions and Denial of Service
29 CVEs
29 CVEs name a weakness of both Race Conditions and Denial of Service, fewer than chance alone would give (about 81). The pairing most often behind it is CWE-362 (Race Condition) with CWE-617 (Reachable Assertion), in 5 CVEs.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy. The named ones come first: exploited in the wild, then those with a public check, then the likeliest to be.
- CVEs that carry a weakness of both
- 29
- Chance alone would give
- about 81
- So they are recorded together
- less often than chance (0.4×)
A CVE counts when its record names a weakness from each class, neither being the other's parent. It says the two kinds of flaw are recorded together in one vulnerability more or less often than chance: not that one causes the other, and it follows how the people who file CVEs choose CWEs.
How this is weighed, and the sources
Chance is what the two classes' shares of all CVEs that carry weaknesses of two or more classes would give if weaknesses paired at random. A line is drawn on the dial from 25 CVEs and 1.15 times chance. Weaknesses are the CWEs the CVE List and NVD record; exploitation is CISA KEV, likelihood is EPSS.
Every one of the 29 is a mark on the map. Named now: 1 to 26, most at risk first.
- A race condition when discarding malformed packets can cause BIND to exit with an assertion failure
- Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and p…
- Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so…
- DietPi-Dashboard Insufficient TLS Handshake Pool
- Axios HTTP/2 Session Cleanup State Corruption Vulnerability
- In FreeBSD 12.1-STABLE before r356908, 12.1-RELEASE before p5, 11.3-STABLE before r356908, and 11.3-RELEASE before p9, a race condition in the cryptodev module permitted a data st…
- There is an Incomplete Cleanup Vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to authentication bypass.
- An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possibly gain privileges by triggering data-structure access duri…
- Copyparty is vulnerable to Regex Denial of Service (ReDoS) attacks through "Recent Uploads" page
- ClassFactory Race Condition and Retained Assembly Memory in Telerik UI for ASP.NET MVC
- Net-SNMP through 5.9.5.2 Denial of Service via Blocking Unauthenticated SMUX Read
- OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling
- Apache CloudStack: Domain/account resources limits not honored
- Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service
- NanoMQ v0.22.7 is vulnerable to Denial of Service (DoS) due to improper resource throttling. A crafted sequence of requests causes the recv-q queue to saturate, leading to the rap…
- Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)
- An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.
- In all Qualcomm products with Android releases from CAF using the Linux kernel, during the wlan calibration data store and retrieve operation, there are some potential race condit…
- Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8
- Dalfox: Unauthenticated Remote DoS via Closed-Channel Write in `ParameterAnalysis` (server mode)
- Pterodactyl's improper resource locking allows raced queries to create more resources than alloted
- VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth
- sock_map: avoid race between sock_map_close and sk_psock_put
- Pterodactyl has a database resource limit bypass via race condition in Client API
- A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS (Frame Information S…
- Kernel: a race condition in crypto module in the function skcipher_recvmsg
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.