Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-367
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
We track 353 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.7. 7 have been exploited in real attacks.
How this weakness is prevented
- Implementation: The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
- Implementation: When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
- Architecture and Design: Limit the interleaving of operations on files from multiple processes.
- Implementation Architecture and Design: If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
- Implementation: Recheck the resource after the use call to verify that the action was taken appropriately.
Latest Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilities
- 7.3 High severity
zbus_polkit: Time-of-check Time-of-use (TOCTOU) Race Condition
Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i).
- 9.4 Critical severity
Google Cloud Build: Insufficient Verification of Data Authenticity
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerabi
- 9.6 Critical severity
klever-go: Integer Underflow (Wrap or Wraparound)
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchas
- 8.1 High severity
Spring Cloud Config: Time-of-check Time-of-use (TOCTOU) Race Condition
The base directory (spring.cloud.config.server.svn.basedir) used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use (TOCTOU) attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Sp
- 7.8 High severity
FreeBSD: Time-of-check Time-of-use (TOCTOU) Race Condition
The FIOSSHMLPGCNF ioctl(2) operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had al
- 8.1 High severity
Apache Tomcat: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0
- 8.1 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)
- 8.3 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.3 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 8.1 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in Start in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)
- 7.1 High severity
PraisonAI: Time-of-check Time-of-use (TOCTOU) Race Condition
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, JobSubmitRequest.validate_webhook_url() accepts webhook_url when resolution raises socket.gaierror because the exception path uses except socket.gaierror: pass. JobExecutor._send_webhook() lat
- 7.1 High severity
ONNX: Improper Limitation of a Pathname to a Restricted Directory
In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with w
- 7.0 High severity
AIX: Time-of-check Time-of-use (TOCTOU) Race Condition
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a time-of-check to time-of-use (TOCTOU) race condition.
- 7.5 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in V8 in Google Chrome prior to 151.0.7922.173 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 7.0 High severity
AIX: Time-of-check Time-of-use (TOCTOU) Race Condition
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges due to a time-of-check to time-of-use (TOCTOU) race condition.
- 7.0 High severity
AIX: Time-of-check Time-of-use (TOCTOU) Race Condition
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a time-of-check to time-of-use (TOCTOU) race condition.
- 7.0 High severity
AIX: Time-of-check Time-of-use (TOCTOU) Race Condition
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite critical files and obtain sensitive information due to a time-of-check to time-of-use (TOCTOU) race condition.
- 7.6 High severity
RK3588s: Time-of-check Time-of-use (TOCTOU) Race Condition
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media (SPI NOR or NAND, EMMC or SD). The code reads the header of the next-stage loader twice. The header contains hashes of the executable mo
- 7.7 High severity
AIX: Time-of-check Time-of-use (TOCTOU) Race Condition
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race condition.
- 7.3 High severity
Dell Command Update (DCU): Time-of-check Time-of-use (TOCTOU) Race Condition
Dell Command Update (DCU), versions prior to 5.7.1, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
- 7.8 High severity
Dell Command Update (DCU): Time-of-check Time-of-use (TOCTOU) Race Condition
Dell Command Update (DCU), versions prior to 5.7.1, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
- 8.8 High severity
FreeBSD: Time-of-check Time-of-use (TOCTOU) Race Condition
During execve(2) of a SUID binary, the new virtual address space is installed before the process credentials are updated. During this window, a process running as the same user can access the target process's memory via procfs or linprocfs, because the kernel'
- 8.3 High severity
Chrome: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in USB in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 8.9 High severity
n8n: Time-of-check Time-of-use (TOCTOU) Race Condition
n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the commu
- 8.5 High severity
budibase: Time-of-check Time-of-use (TOCTOU) Race Condition
Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing
- 7.5 High severity
i: Time-of-check Time-of-use (TOCTOU) Race Condition
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use (TOCTOU) race condition involving symbolic links.
- 9.9 Critical severity
LXD: Time-of-check Time-of-use (TOCTOU) Race Condition
An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance copies. When copying an instance to a target project, LXD perfor
- 7.8 High severity
zephyr: Time-of-check Time-of-use (TOCTOU) Race Condition
The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_msghdr into a kernel-side copy with k_usermode_from_copy(), but then re-read the still-live user struc
- 7.0 High severity
Windows 10 Version 1607: Out-of-bounds Read
Time-of-check time-of-use (toctou) race condition in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
- 8.8 High severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcn_v4_0_enc_find_ib_param() instead of rereading it from the IB. This avoids a potential TOCTOU issue i
- 7.4 High severity
fastschema: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes.
- 8.1 High severity
llama.cpp: Time-of-check Time-of-use (TOCTOU) Race Condition
llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and
- 8.1 High severity
Apache CXF: Time-of-check Time-of-use (TOCTOU) Race Condition
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3,
- 7.5 High severity
PraisonAI: Time-of-check Time-of-use (TOCTOU) Race Condition
PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check
- 8.5 High severity
memos: Time-of-check Time-of-use (TOCTOU) Race Condition
Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the origin
- 8.9 High severity
misskey: Time-of-check Time-of-use (TOCTOU) Race Condition
Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature validation and the compaction process. Because the JSON-LD parsing context is not shared be
- 7.4 High severity
netty: Time-of-check Time-of-use (TOCTOU) Race Condition
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows t
- 7.5 High severity
datamodel-code-generator: Reliance on Reverse DNS Resolution for a Security-Critical Action
datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.63.0, datamodel-code-generator validates a URL host once in src/datamod
- 7.8 High severity
Xen: Time-of-check Time-of-use (TOCTOU) Race Condition
When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the
- 7.1 High severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that ne