Race Condition / TOCTOU
High · Logic
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-362
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-362
Definition
Time-of-check vs time-of-use lets parallel requests bypass limits.
Root cause
Non-atomic checks on shared state.
Affected components
- Components in the “Logic” class
- Application / API handlers
- Supporting libraries
Impact
Double-spend, limit bypass.
Severity
High
Safe lab reproduction
PortSwigger race condition labs
Detection methodology
Parallel request testing.
Evidence examples
- Lab reproduction notes: PortSwigger race condition labs
- Request/response excerpts (redacted)
- Detection signal: Parallel request testing
Remediation
Atomic operations / transactions / locking.
Secure coding examples
Server-side atomic balance updates.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.