MITRE’s description of CWE-362: The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Common consequences MITRE lists
- Availability: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
- Availability: DoS: Crash, Exit, or Restart; DoS: Instability
- Confidentiality, Integrity: Read Files or Directories; Read Application Data
- Access Control: Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity; Bypass Protection Mechanism
Attackers send requests in parallel on purpose to spend credit twice, bypass limits or corrupt state, and these bugs rarely appear in sequential tests.
- Make the check and the update one atomic operation: a conditional update, a unique constraint or a transaction at the right isolation level.
- Use idempotency keys for operations that must happen once.
- Test invariants with many concurrent requests, not only one at a time.
Guides on this site
Preserve business invariants under concurrent requests
Make a balance, reservation or approval rule hold when requests overlap, retry and fail halfway through.
Account recovery: password resets, help-desk resets and account linking
Treat password resets, support-desk recovery and account linking as new grants of authority: single-use high-entropy proofs, atomic consumption, session revocation, and stable identity rather than email matching.
Bound background jobs and make retries safe
Keep queues, workers and paid dependencies within a defined budget when clients retry, cancel or disappear.
Abuse case library: tests and controls by feature
Recurring abuse cases for sign-up and login, password reset, MFA enrolment, invites, file upload, payments and coupons, webhooks, search, export, admin and AI chat or agents: the attacker goal, preconditions, a concrete test and the control, each linked to CWE and CAPEC.
Practice
- Race condition lab: Repair a balance check that races · Browser lab
- Password reset token lab: Make a recovery credential single-use · Browser lab
- Business logic lab: Price an order without trusting the client · Browser lab
- Make a checkout transaction atomic · Local project
References
List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.