Variant weakness
Draft
CWE-572: Call to Thread run() instead of start()
The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee.
Last updated
0
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Not rated
Likelihood of exploit
Per MITRE
Variant
Abstraction
MITRE classification
Overview
In most cases a direct call to a Thread object's run() method is a bug. The programmer intended to begin a new thread of control, but accidentally called run() instead of start(), so the run() method will execute in the caller's thread of control.
Common consequences
What can happen when CWE-572 is exploited.
Quality Degradation, Varies by Context
Affects: Other
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Implementation
Applies to
Languages
Java
How to prevent it
Practical mitigations for CWE-572, grouped by where in the lifecycle they apply.
Implementation
Use the start() method instead of the run() method.