1255
CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded
Context
Weakness ID : 543
Structure : Simple
Abstraction : Variant
Description
The product uses the singleton pattern when creating a resource within a multithreaded
environment.
Extended Description
The use of a singleton pattern may not be thread-safe.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 820 Missing Synchronization 1720
Relevant to the view "CISQ Quality Measures (2020)" (CWE-1305)
Nature Type ID Name Page
ChildOf 662 Improper Synchronization 1448
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ChildOf 662 Improper Synchronization 1448
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other
Integrity
Other
Modify Application Data
Potential Mitigations
Phase: Architecture and Design
Use the Thread-Specific Storage Pattern. See References.
Phase: Implementation
Do not use member fields to store information in the Servlet. In multithreading environments,
storing user data in Servlet member fields introduces a data access race condition.
Phase: Implementation
Avoid using the double-checked locking pattern in language versions that cannot guarantee
thread safety. This pattern may be used to avoid the overhead of a synchronized call, but
in certain versions of Java (for example), this has been shown to be unsafe because it still
introduces a race condition (CWE-209).
Effectiveness = Limited
CWE Version 4.14
CWE-544: Missing Standardized Error Handling Mechanism
CWE-544: Missing Standardized Error Handling Mechanism