What CVEs are caused by CWE-833?

21 recorded CVEs are attributed to CWE-833, including CVE-2025-10150, CVE-2021-1622, CVE-2024-47506.

Is CWE-833 actively exploited?

21 recorded CVEs are caused by CWE-833; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Base weakness

Incomplete

CWE-833: Deadlock

The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

Last updated May 1, 2026

21

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

CWE-833 (Deadlock) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

21 recorded CVEs are caused by CWE-833 (Deadlock). The highest-severity and most recent are shown first. 3 new CWE-833 CVEs have been recorded so far in 2026 (8 in 2025).

CVE-2025-59463

Denial-of-service (DoS) via chunk size mismatch

High · CVSS 7.5 · EPSS 30th

2025-10-27

CVE-2025-36010

IBM Db2 for Linux denial of service

High · CVSS 7.5 · EPSS 15th

2025-07-29

CVE-2025-1713

deadlock potential with VT-d and legacy PCI device pass-through

High · CVSS 7.5 · EPSS 50th

2025-07-17

CVE-2024-29172

High · CVSS 7.5 · EPSS 35th

2025-02-12

CVE-2022-43767

High · CVSS 7.5 · EPSS 50th

2023-04-11

CVE-2025-8312

High · CVSS 7.1 · EPSS 22th

2025-07-30

CVE-2026-33904

Ella Core has a Denial of Service via SCTP connection cleanup deadlock

Medium · CVSS 6.5 · EPSS 6th

2026-03-27

CVE-2025-21313

Windows Security Account Manager (SAM) Denial of Service Vulnerability

Medium · CVSS 6.5 · EPSS 73th

2025-01-14

CVE-2024-8447

Narayana: deadlock via multiple join requests sent to lra coordinator

Medium · CVSS 5.9 · EPSS 46th

2025-01-02

Showing 12 of 21 recorded CWE-833 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-833 vulnerabilities

Common consequences

What can happen when CWE-833 is exploited.

DoS: Resource Consumption (CPU), DoS: Resource Consumption (Other), DoS: Crash, Exit, or Restart

Affects: Availability

Each thread of execution will "hang" and prevent tasks from completing. In some cases, CPU consumption may occur if a lock check occurs in a tight loop.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-1999-1476 — A bug in some Intel Pentium processors allow DoS (hang) via an invalid "CMPXCHG8B" instruction, causing a deadlock
CVE-2009-2857 — OS deadlock
CVE-2009-1961 — OS deadlock involving 3 separate functions
CVE-2009-2699 — deadlock in library
CVE-2009-4272 — deadlock triggered by packets that force collisions in a routing table
CVE-2002-1850 — read/write deadlock between web server and script
CVE-2004-0174 — web server deadlock involving multiple listening connections
CVE-2009-1388 — multiple simultaneous calls to the same function trigger deadlock.
CVE-2006-5158 — chain: other weakness leads to NULL pointer dereference (CWE-476) or deadlock (CWE-833).
CVE-2006-4342 — deadlock when an operation is performed on a resource while it is being removed.
CVE-2006-2374 — Deadlock in device driver triggered by using file handle of a related device.
CVE-2006-2275 — Deadlock when large number of small messages cannot be processed quickly enough.
CVE-2005-3847 — OS kernel has deadlock triggered by a signal during a core dump.
CVE-2005-3106 — Race condition leads to deadlock.
CVE-2005-2456 — Chain: array index error (CWE-129) leads to deadlock (CWE-833)

Terminology & mappings

Mapped taxonomies

The CERT Oracle Secure Coding Standard for Java (2011): Ensure actively held locks are released on exceptional conditions (LCK08-J)

Attack patterns

CAPEC attack patterns that exploit this weakness.

CAPEC-25: Forced Deadlock

Frequently asked questions

Common questions about CWE-833.

What is CWE-833?: The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
What CVEs are caused by CWE-833?: 21 recorded CVEs are attributed to CWE-833, including CVE-2025-10150, CVE-2021-1622, CVE-2024-47506.
How is CWE-833 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-833?: Exploiting CWE-833 can lead to: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Other), DoS: Crash, Exit, or Restart.
Is CWE-833 actively exploited?: 21 recorded CVEs are caused by CWE-833; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-833

Get alerted the moment a new CWE-833 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing