CWE-1042 describes code with a member declared static, but not final, inside a class that is not a singleton. A singleton here means a class used only once in the target of a create action. MITRE lists it as a Variant that applies to any language.
How it happens
A static field belongs to the class, not to each instance. If the class is created many times, every instance shares that one field. When it is also not final, any instance can change it.
public class Session {
// Shared by every Session object, and changeable by any of them
static String lastUser;
}
MITRE's stated consequence is reduced performance. The issue can make the product perform more slowly, and if the relevant code is reachable by an attacker, that performance problem might introduce a vulnerability. No CVEs are observed for this entry, so treat it as a quality weakness with an indirect risk.
Shared mutable state also invites race conditions in threaded code, though MITRE's entry does not state that.
How to find it
MITRE lists no detection methods. A code review or a static analysis rule that flags non final static fields in non singleton classes will find it. Search for the static keyword on mutable fields.
How to fix it
MITRE lists no formal mitigations. Reasonable steps:
- Make the field an instance member if each object should have its own value.
- Make it final if it is a constant.
- If sharing is intended, make that explicit with a singleton or a documented shared holder, and guard access.
Quick check
What does MITRE say the effect is?
Reduced performance, which could become a vulnerability if an attacker can reach the affected code.
