CWE-609 Base Draft

Double-Checked Locking

Double-checked locking is an insufficient synchronization pattern where a program checks a resource's state, acquires a lock, and checks the state again before initialization, failing to guarantee…

Definition

What is CWE-609?

Double-checked locking is an insufficient synchronization pattern where a program checks a resource's state, acquires a lock, and checks the state again before initialization, failing to guarantee thread safety across all systems.
Double-checked locking attempts to optimize performance by avoiding the cost of synchronization on every access. A thread first checks if a resource (like an object) is initialized without a lock. If it appears uninitialized, the thread then acquires a lock, performs a second check, and only initializes the resource if the second check also confirms it's needed. This pattern aims to minimize lock contention but is fundamentally flawed. The core issue is that this sequence is not guaranteed to be atomic or visible in the same order to other threads running concurrently. Without proper synchronization on the initial check, other threads might see a partially constructed object or cache the uninitialized state, leading to unpredictable behavior and crashes. Because memory model guarantees vary across programming languages and hardware architectures, this pattern is unreliable and should be replaced with thread-safe initialization methods.
Real-world impact

Real-world CVEs caused by CWE-609

No public CVE references are linked to this CWE in MITRE's catalog yet.

How attackers exploit it

Step-by-step attacker path

  1. 1

    It may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization...

  2. 2

    The programmer wants to guarantee that only one Helper() object is ever allocated, but does not want to pay the cost of synchronization every time this code is called.

  3. 3

    Suppose that helper is not initialized. Then, thread A sees that helper==null and enters the synchronized block and begins to execute:

  4. 4

    If a second thread, thread B, takes over in the middle of this call and helper has not finished running the constructor, then thread B may make calls on helper while its fields hold incorrect values.

Vulnerable code example

Vulnerable Java

It may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization...

Vulnerable Java 
if (helper == null) {
  		synchronized (this) {
  			if (helper == null) {
  				helper = new Helper();
  			}
  		}
  }
  return helper;
Secure code example

Secure pseudo

Secure pseudo 
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Prevention checklist

How to prevent CWE-609

  • Implementation While double-checked locking can be achieved in some languages, it is inherently flawed in Java before 1.5, and cannot be achieved without compromising platform independence. Before Java 1.5, only use of the synchronized keyword is known to work. Beginning in Java 1.5, use of the "volatile" keyword allows double-checked locking to work successfully, although there is some debate as to whether it achieves sufficient performance gains. See references.
Detection signals

How to detect CWE-609

SAST High

Run static analysis (SAST) on the codebase looking for the unsafe pattern in the data flow.

DAST Moderate

Run dynamic application security testing against the live endpoint.

Runtime Moderate

Watch runtime logs for unusual exception traces, malformed input, or authorization bypass attempts.

Code review Moderate

Code review: flag any new code that handles input from this surface without using the validated framework helpers.

Plexicus auto-fix

Plexicus auto-detects CWE-609 and opens a fix PR in under 60 seconds.

Codex Remedium scans every commit, identifies this exact weakness, and ships a reviewer-ready pull request with the patch. No tickets. No hand-offs.

Get a demo Try Plexicus free
Frequently asked questions

Frequently asked questions

What is CWE-609?

Double-checked locking is an insufficient synchronization pattern where a program checks a resource's state, acquires a lock, and checks the state again before initialization, failing to guarantee thread safety across all systems.

How serious is CWE-609?

MITRE has not published a likelihood-of-exploit rating for this weakness. Treat it as medium-impact until your threat model proves otherwise.

What languages or platforms are affected by CWE-609?

MITRE lists the following affected platforms: Java.

How can I prevent CWE-609?

While double-checked locking can be achieved in some languages, it is inherently flawed in Java before 1.5, and cannot be achieved without compromising platform independence. Before Java 1.5, only use of the synchronized keyword is known to work. Beginning in Java 1.5, use of the "volatile" keyword allows double-checked locking to work successfully, although there is some debate as to whether it achieves sufficient performance gains. See references.

How does Plexicus detect and fix CWE-609?

Plexicus's SAST engine matches the data-flow signature for CWE-609 on every commit. When a match is found, our Codex Remedium agent opens a fix PR with the corrected code, tests, and a one-line summary for the reviewer.

Where can I learn more about CWE-609?

MITRE publishes the canonical definition at https://cwe.mitre.org/data/definitions/609.html. You can also reference OWASP and NIST documentation for adjacent guidance.

Related weaknesses

Weaknesses related to CWE-609

CWE-667 Parent

Improper Locking

This vulnerability occurs when a program fails to correctly acquire or release a lock on a shared resource, such as a file, database…

CWE-1232 Sibling

Improper Lock Behavior After Power State Transition

This vulnerability occurs when a hardware lock bit, designed to protect critical system configuration registers, is improperly reset or…

CWE-1233 Sibling

Security-Sensitive Hardware Controls with Missing Lock Bit Protection

This vulnerability occurs when a hardware device uses a lock bit to protect critical configuration registers, but the lock fails to…

CWE-1234 Sibling

Hardware Internal or Debug Modes Allow Override of Locks

Hardware debug modes or internal states can bypass critical system lock protections, allowing unauthorized changes to device configuration.

CWE-412 Sibling

Unrestricted Externally Accessible Lock

This vulnerability occurs when a system correctly checks for a lock's existence, but an unauthorized external actor can control or…

CWE-413 Sibling

Improper Resource Locking

This vulnerability occurs when an application fails to properly lock a shared resource, such as a file or memory location, before…

CWE-414 Sibling

Missing Lock Check

This vulnerability occurs when software fails to verify that a proper synchronization lock is active before accessing or modifying a…

CWE-764 Sibling

Multiple Locks of a Critical Resource

This vulnerability occurs when a critical resource, such as a file, data structure, or connection, is locked more times than the software…

CWE-765 Sibling

Multiple Unlocks of a Critical Resource

This vulnerability occurs when a critical resource, like a lock or semaphore, is unlocked more times than it was locked, putting the…

Resources

Further reading

Ready when you are

Don't Let Security
Weigh You Down.

Stop choosing between AI velocity and security debt. Plexicus is the only platform that runs Vibe Coding Security and ASPM in parallel — one workflow, every codebase.