CWE-413: Improper Resource Locking
The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
Last updated
Overview
When a resource is not properly locked, an attacker could modify the resource while it is being operated on by the product. This might violate the product's assumption that the resource will not change, potentially leading to unexpected behaviors.
Real-world CVEs
15 recorded CVEs are caused by CWE-413 (Improper Resource Locking). The highest-severity and most recent are shown first. 3 new CWE-413 CVEs have been recorded so far in 2026 (4 in 2025).
- CVE-2025-3450
Automation Runtime SDM requests may impact system
Critical · CVSS 9.3 · EPSS 18th2025-10-07 - CVE-2026-32748
Squid has Denial of Service in ICP Response handling
High · CVSS 8.7 · EPSS 95th2026-03-26 - CVE-2023-28649High · CVSS 8.6 · EPSS 42th2023-05-22
- CVE-2022-20678High · CVSS 8.6 · EPSS 59th2022-04-15
- CVE-2019-17102
Bitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)
High · CVSS 8.3 · EPSS 79th2020-01-27 - CVE-2019-8998High · CVSS 7.8 · EPSS 13th2019-07-12
- CVE-2022-49737High · CVSS 7.7 · EPSS 25th2025-03-16
- CVE-2022-24946High · CVSS 7.5 · EPSS 74th2022-06-15
- CVE-2025-0003High · CVSS 7.3 · EPSS 8th2025-11-24
- CVE-2023-33951
Kernel: vmwgfx: race condition leading to information disclosure vulnerability
Medium · CVSS 6.7 · EPSS 27th2023-07-24 - CVE-2025-69198
Pterodactyl's improper resource locking allows raced queries to create more resources than alloted
Medium · CVSS 6.0 · EPSS 12th2026-01-19 - CVE-2023-32253
Kernel: deadlock in ksmbd_find_crypto_ctx()
Medium · CVSS 5.9 · EPSS 22th2025-08-02
Showing 12 of 15 recorded CWE-413 CVEs. Track new ones as they are published and get AI-written analysis and fixes.
Monitor CWE-413 vulnerabilitiesCommon consequences
What can happen when CWE-413 is exploited.
Modify Application Data, DoS: Instability, DoS: Crash, Exit, or Restart
Affects: Integrity, Availability
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
How to prevent it
Practical mitigations for CWE-413, grouped by where in the lifecycle they apply.
Use a non-conflicting privilege scheme.
Use synchronization when locking a resource.
How to detect it
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Effectiveness: High
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
The following function attempts to acquire a lock in order to perform operations on a shared resource.
Vulnerable example
void f(pthread_mutex_t *mutex) {Safe example
int f(pthread_mutex_t *mutex) {This Java example shows a simple BankAccount class with deposit and withdraw methods.
Vulnerable example
public class BankAccount {Safe example
public class BankAccount {Safe example
public class BankAccount {Illustrative examples
Real CVEs that MITRE cites as examples of this weakness.
- CVE-2022-20141 — Chain: an operating system kernel has insufficent resource locking (CWE-413) leading to a use after free (CWE-416).
Terminology & mappings
Mapped taxonomies
- PLOVER: Insufficient Resource Locking
- The CERT Oracle Secure Coding Standard for Java (2011): Ensure visibility when accessing shared primitive variables (VNA00-J)
- The CERT Oracle Secure Coding Standard for Java (2011): Ensure that compound operations on shared variables are atomic (VNA02-J)
- The CERT Oracle Secure Coding Standard for Java (2011): Use private final lock objects to synchronize classes that may interact with untrusted code (LCK00-J)
- Software Fault Patterns: Missing Lock (SFP19)
Frequently asked questions
Common questions about CWE-413.
- What is CWE-413?
- The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
- What CVEs are caused by CWE-413?
- 15 recorded CVEs are attributed to CWE-413, including CVE-2025-3450, CVE-2026-32748, CVE-2023-28649.
- How do you prevent CWE-413?
- Use a non-conflicting privilege scheme.
- How is CWE-413 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-413?
- Exploiting CWE-413 can lead to: Modify Application Data, DoS: Instability, DoS: Crash, Exit, or Restart.
- Is CWE-413 actively exploited?
- 15 recorded CVEs are caused by CWE-413; none are currently in CISA's KEV catalog of actively exploited flaws.
References
- MITRE CWE definition (CWE-413) (opens in a new tab)
- CWE-413 vulnerabilities on NVD (opens in a new tab)
- Learn: What is a CWE?
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Stay ahead of CWE-413
Get alerted the moment a new CWE-413 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.