Weaknesses of type CWE-459

86 results

Limpeza incompleta de recursos

Ocorre quando o software falha em liberar ou limpar completamente recursos (memória, arquivos abertos, conexões de rede, dados sensíveis em memória) antes de encerrar um processo ou função. Isso permite vazamento de dados sensíveis, consumo não controlado de recursos ou comportamentos inesperados em estados posteriores do programa.

Example

Uma aplicação autentica um usuário, armazena a senha em uma variável de buffer, mas encerra a sessão sem sobrescrever o buffer com zeros. Um atacante com acesso à memória pode recuperar a senha ainda presente. Ou um arquivo temporário com dados confidenciais não é deletado após o uso, ficando acessível no disco.

How to mitigate

Implemente handlers de limpeza explícitos (finally, destructores, context managers em Python) que garantam liberação de recursos mesmo em casos de erro. Para dados sensíveis, sobrescreva com zeros antes de liberar memória. Use ferramentas de análise estática e testes de vazamento de memória (valgrind, AddressSanitizer) para detectar limpezas incompletas.

CVE-2025-31650HIGHApache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frameEPSS 59.9%CVE-2022-1552—A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another usEPSS 12.5%CVE-2022-21125MEDIUMIncomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable infoEPSS 6.5%CVE-2023-41835HIGHApache Struts: excessive disk usageEPSS 6.3%CVE-2022-21123MEDIUMIncomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable informatiEPSS 6.2%CVE-2022-21166MEDIUMIncomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentiallyEPSS 5.8%CVE-2022-21127MEDIUMIncomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially EPSS 5.5%CVE-2022-1473HIGHResource leakage when decoding certificates and keysEPSS 2.5%CVE-2024-23672MEDIUMApache Tomcat: WebSocket DoS with incomplete closing handshakeEPSS 2.3%CVE-2023-42795MEDIUMApache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requestsEPSS 2.2%CVE-2023-42794—Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on WindowsEPSS 1.9%CVE-2023-36468CRITICALUpgrading doesn't prevent exploiting vulnerable XWiki documentsEPSS 1.8%CVE-2025-64775HIGHApache Struts: File leak in multipart request processing causes disk exhaustion (DoS)EPSS 1.5%CVE-2022-45347CRITICALApache ShardingSphere-Proxy: MySQL authentication bypassEPSS 1.4%CVE-2021-32928—The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows iEPSS 1.3%CVE-2023-0836HIGHAn information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.EPSS 1.2%CVE-2020-12494MEDIUMBeckhoff: Etherleak in TwinCAT RT network driverEPSS 1.0%CVE-2021-36205HIGHMetasys session tokenEPSS 1.0%CVE-2025-2260HIGHEclipse ThreadX NetX Duo HTTP component server denial of serviceEPSS 0.9%CVE-2025-0726HIGHEclipse ThreadX NetX Duo HTTP server denial of serviceEPSS 0.7%