CWE-1058 describes a function or method that runs in a multi-threaded environment but owns an unsafe, non-final static storable or member data element. Servers, request handlers and background workers in Java and similar languages are where this shows up.
How it happens
A static field is shared by every thread. If it can change, two threads can change it at the same time, and one request can see another request's data.
// Pattern to avoid: shared mutable static state in a request handler
public class Handler {
private static String currentUser;
public void handle(Request r) {
currentUser = r.user();
process();
}
}
// Better: keep state local to the call
public class Handler {
public void handle(Request r) {
String user = r.user();
process(user);
}
}
What an attacker gains
MITRE lists reduced reliability. If an attacker can reach the code, the reliability problem "might introduce a vulnerability."
How to find it
The record lists no detection methods. Search for static fields that are not final in classes used by concurrent code, and review each one.
How to fix it
- Make shared fields final where they never change.
- Move per-request state into local variables or per-request objects.
- If shared mutable state is truly needed, guard it with proper synchronization or use thread-safe types.
Quick check
Why does a static field matter more under threads?
All threads share one copy, so concurrent writes can interleave and corrupt the value.
