CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded Context
Description
The product uses the singleton pattern when creating a resource within a multithreaded environment.
The use of a singleton pattern may not be thread-safe.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Incomplete
Common consequences
- OtherIntegrity
Other; Modify Application Data
Potential mitigations
- Architecture and Design
Use the Thread-Specific Storage Pattern. See References.
- Implementation
Do not use member fields to store information in the Servlet. In multithreading environments, storing user data in Servlet member fields introduces a data access race condition.
- ImplementationEffectiveness: Limited
Avoid using the double-checked locking pattern in language versions that cannot guarantee thread safety. This pattern may be used to avoid the overhead of a synchronized call, but in certain versions of Java (for example), this has been shown to be unsafe because it still introduces a race condition (CWE-209).
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.