CWE-609: Double-Checked Locking

Definition

What is CWE-609?

Double-checked locking is an insufficient synchronization pattern where a program checks a resource's state, acquires a lock, and checks the state again before initialization, failing to guarantee thread safety across all systems.

Double-checked locking attempts to optimize performance by avoiding the cost of synchronization on every access. A thread first checks if a resource (like an object) is initialized without a lock. If it appears uninitialized, the thread then acquires a lock, performs a second check, and only initializes the resource if the second check also confirms it's needed. This pattern aims to minimize lock contention but is fundamentally flawed. The core issue is that this sequence is not guaranteed to be atomic or visible in the same order to other threads running concurrently. Without proper synchronization on the initial check, other threads might see a partially constructed object or cache the uninitialized state, leading to unpredictable behavior and crashes. Because memory model guarantees vary across programming languages and hardware architectures, this pattern is unreliable and should be replaced with thread-safe initialization methods.

Real-world impact

Real-world CVEs caused by CWE-609

No public CVE references are linked to this CWE in MITRE's catalog yet.

How attackers exploit it

Step-by-step attacker path

1
It may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization...
2
The programmer wants to guarantee that only one Helper() object is ever allocated, but does not want to pay the cost of synchronization every time this code is called.
3
Suppose that helper is not initialized. Then, thread A sees that helper==null and enters the synchronized block and begins to execute:
4
If a second thread, thread B, takes over in the middle of this call and helper has not finished running the constructor, then thread B may make calls on helper while its fields hold incorrect values.

Vulnerable code example

Vulnerable Java

It may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization...

Vulnerable Java

if (helper == null) {
  		synchronized (this) {
  			if (helper == null) {
  				helper = new Helper();
  			}
  		}
  }
  return helper;

Secure code example

Secure pseudo

// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Prevention checklist

How to prevent CWE-609

Implementation While double-checked locking can be achieved in some languages, it is inherently flawed in Java before 1.5, and cannot be achieved without compromising platform independence. Before Java 1.5, only use of the synchronized keyword is known to work. Beginning in Java 1.5, use of the "volatile" keyword allows double-checked locking to work successfully, although there is some debate as to whether it achieves sufficient performance gains. See references.

Detection signals

How to detect CWE-609

SAST High

Run static analysis (SAST) on the codebase looking for the unsafe pattern in the data flow.

DAST Moderate

Run dynamic application security testing against the live endpoint.

Runtime Moderate

Watch runtime logs for unusual exception traces, malformed input, or authorization bypass attempts.

Code review Moderate

Code review: flag any new code that handles input from this surface without using the validated framework helpers.

CWE-609

Don't catalog this weakness. Prove it's reachable.

Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.

Request AI Swarm Pentest

Frequently asked questions

What is CWE-609?

Double-checked locking is an insufficient synchronization pattern where a program checks a resource's state, acquires a lock, and checks the state again before initialization, failing to guarantee thread safety across all systems.

How serious is CWE-609?

MITRE has not published a likelihood-of-exploit rating for this weakness. Treat it as medium-impact until your threat model proves otherwise.

What languages or platforms are affected by CWE-609?

MITRE lists the following affected platforms: Java.

How can I prevent CWE-609?

While double-checked locking can be achieved in some languages, it is inherently flawed in Java before 1.5, and cannot be achieved without compromising platform independence. Before Java 1.5, only use of the synchronized keyword is known to work. Beginning in Java 1.5, use of the "volatile" keyword allows double-checked locking to work successfully, although there is some debate as to whether it achieves sufficient performance gains. See references.

How does Plexicus detect and fix CWE-609?

Plexicus's SAST engine matches the data-flow signature for CWE-609 on every commit. When a match is found, our Codex Remedium agent opens a fix PR with the corrected code, tests, and a one-line summary for the reviewer.

Where can I learn more about CWE-609?

MITRE publishes the canonical definition at https://cwe.mitre.org/data/definitions/609.html. You can also reference OWASP and NIST documentation for adjacent guidance.

Related weaknesses

Weaknesses related to CWE-609

CWE-667 Parent

Ready to validate what matters?

Plexicus is Proof-Driven AppSec: validated findings, contextual understanding, and reviewed remediation — anchored in evidence, scoped with you.

Request AI Swarm Pentest

Double-Checked Locking

What is CWE-609?

Real-world CVEs caused by CWE-609

Step-by-step attacker path

Vulnerable Java

Secure pseudo

How to prevent CWE-609

How to detect CWE-609

Don't catalog this weakness. Prove it's reachable.

Frequently asked questions

Weaknesses related to CWE-609

Improper Locking

Improper Lock Behavior After Power State Transition

Security-Sensitive Hardware Controls with Missing Lock Bit Protection

Hardware Internal or Debug Modes Allow Override of Locks

Unrestricted Externally Accessible Lock

Improper Resource Locking

Missing Lock Check

Multiple Locks of a Critical Resource

Multiple Unlocks of a Critical Resource

Further reading

Ready to validate what matters?

Check whether AI Swarm Pentest fits your environment.

Request received. Book the next step.

Sample evidence handover

Server-Side Request Forgery in `webhooks/receiver`