The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

What CVEs are caused by CWE-833?

22 recorded CVEs are attributed to CWE-833, including CVE-2025-10150, CVE-2021-1622, CVE-2024-47506.

Is CWE-833 actively exploited?

22 recorded CVEs are caused by CWE-833; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-833: Deadlock

Overview

CWE-833 (Deadlock) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

22 recorded CVEs are caused by CWE-833 (Deadlock). The highest-severity and most recent are shown first. 4 new CWE-833 CVEs have been recorded so far in 2026 (8 in 2025).

CVE-2025-10150
Webserver crash caused by scanning on TCP port 80
High · CVSS 8.7 · EPSS 15th
2025-10-28
CVE-2021-1622
High · CVSS 8.6 · EPSS 60th
2021-09-23
CVE-2024-47506
High · CVSS 8.2 · EPSS 21th
2024-10-11
CVE-2025-59463
Denial-of-service (DoS) via chunk size mismatch
High · CVSS 7.5 · EPSS 31th
2025-10-27
CVE-2025-36010
IBM Db2 for Linux denial of service
High · CVSS 7.5 · EPSS 15th
2025-07-29
CVE-2025-1713
deadlock potential with VT-d and legacy PCI device pass-through
High · CVSS 7.5 · EPSS 51th
2025-07-17
CVE-2024-29172
High · CVSS 7.5 · EPSS 37th
2025-02-12
CVE-2022-43767
High · CVSS 7.5 · EPSS 51th
2023-04-11
CVE-2026-70616
boringproxy 0.10.0 Resource Exhaustion DoS via GET /loading endpoint
High · CVSS 7.1 · EPSS 10th
2026-08-05
CVE-2025-8312
High · CVSS 7.1 · EPSS 23th
2025-07-30
CVE-2026-33904
Ella Core has a Denial of Service via SCTP connection cleanup deadlock
Medium · CVSS 6.5 · EPSS 6th
2026-03-27
CVE-2025-21313
Windows Security Account Manager (SAM) Denial of Service Vulnerability
Medium · CVSS 6.5 · EPSS 75th
2025-01-14

Showing 12 of 22 recorded CWE-833 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-833 vulnerabilities

Common consequences

What can happen when CWE-833 is exploited.

DoS: Resource Consumption (CPU), DoS: Resource Consumption (Other), DoS: Crash, Exit, or Restart

Affects: Availability

Each thread of execution will "hang" and prevent tasks from completing. In some cases, CPU consumption may occur if a lock check occurs in a tight loop.

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-1999-1476 — A bug in some Intel Pentium processors allow DoS (hang) via an invalid "CMPXCHG8B" instruction, causing a deadlock
CVE-2009-2857 — OS deadlock
CVE-2009-1961 — OS deadlock involving 3 separate functions
CVE-2009-2699 — deadlock in library
CVE-2009-4272 — deadlock triggered by packets that force collisions in a routing table
CVE-2002-1850 — read/write deadlock between web server and script
CVE-2004-0174 — web server deadlock involving multiple listening connections
CVE-2009-1388 — multiple simultaneous calls to the same function trigger deadlock.
CVE-2006-5158 — chain: other weakness leads to NULL pointer dereference (CWE-476) or deadlock (CWE-833).
CVE-2006-4342 — deadlock when an operation is performed on a resource while it is being removed.
CVE-2006-2374 — Deadlock in device driver triggered by using file handle of a related device.
CVE-2006-2275 — Deadlock when large number of small messages cannot be processed quickly enough.
CVE-2005-3847 — OS kernel has deadlock triggered by a signal during a core dump.
CVE-2005-3106 — Race condition leads to deadlock.
CVE-2005-2456 — Chain: array index error (CWE-129) leads to deadlock (CWE-833)

How this weakness relates to others in the CWE hierarchy.

Parent

Terminology & mappings

Mapped taxonomies

The CERT Oracle Secure Coding Standard for Java (2011): Ensure actively held locks are released on exceptional conditions (LCK08-J)

Attack patterns

CAPEC attack patterns that exploit this weakness.

CAPEC-25: Forced Deadlock

Frequently asked questions

Common questions about CWE-833.

What is CWE-833?: The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
What CVEs are caused by CWE-833?: 22 recorded CVEs are attributed to CWE-833, including CVE-2025-10150, CVE-2021-1622, CVE-2024-47506.
How is CWE-833 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-833?: Exploiting CWE-833 can lead to: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Other), DoS: Crash, Exit, or Restart.
Is CWE-833 actively exploited?: 22 recorded CVEs are caused by CWE-833; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.