Weaknesses of type CWE-459

158 results

Limpeza incompleta de recursos

Ocorre quando o software falha em liberar ou limpar completamente recursos (memória, arquivos abertos, conexões de rede, dados sensíveis em memória) antes de encerrar um processo ou função. Isso permite vazamento de dados sensíveis, consumo não controlado de recursos ou comportamentos inesperados em estados posteriores do programa.

Example

Uma aplicação autentica um usuário, armazena a senha em uma variável de buffer, mas encerra a sessão sem sobrescrever o buffer com zeros. Um atacante com acesso à memória pode recuperar a senha ainda presente. Ou um arquivo temporário com dados confidenciais não é deletado após o uso, ficando acessível no disco.

How to mitigate

Implemente handlers de limpeza explícitos (finally, destructores, context managers em Python) que garantam liberação de recursos mesmo em casos de erro. Para dados sensíveis, sobrescreva com zeros antes de liberar memória. Use ferramentas de análise estática e testes de vazamento de memória (valgrind, AddressSanitizer) para detectar limpezas incompletas.

CVE-2024-50385MEDIUMA denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A speEPSS 0.8%CVE-2025-0726HIGHEclipse ThreadX NetX Duo HTTP server denial of serviceEPSS 0.8%CVE-2026-28268CRITICALVikunja Vulnerable to Account Takeover via Password Reset Token ReuseEPSS 0.7%CVE-2026-3304HIGHMulter vulnerable to Denial of Service via incomplete cleanupEPSS 0.7%CVE-2022-39368HIGHCalifornium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of recordsEPSS 0.7%CVE-2023-20862MEDIUMIn Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support doesEPSS 0.6%CVE-2025-21609HIGHSiYuan has an arbitrary file deletion vulnerabilityEPSS 0.6%CVE-2024-26005MEDIUMPHOENIX CONTACT: Privilege gain through incomplete cleanup in CHARX SeriesEPSS 0.6%CVE-2026-113658HIGHApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryEPSS 0.6%CVE-2026-34263CRITICALMissing authentication check in SAP Commerce cloud configurationEPSS 0.6%CVE-2026-52736HIGHZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cacheEPSS 0.6%CVE-2026-77761MEDIUMCross-Document Parser State Contamination in misp-stixEPSS 0.6%CVE-2026-42492HIGHvIRQ event channel binding may break XenstoreEPSS 0.6%CVE-2025-66675HIGHApache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixedEPSS 0.6%CVE-2026-93446HIGHApache Tomcat: Possible TLS 1.3 connection failuresEPSS 0.6%CVE-2022-44546HIGHThe kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation EPSS 0.6%CVE-2026-88932MEDIUMmulter vulnerable to Denial of Service via orphaned disk writes on aborted uploadsEPSS 0.5%CVE-2021-4002—A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmgetEPSS 0.5%CVE-2026-88041HIGHApache Tomcat: HTTP/2 trailer header cross-contaminationEPSS 0.5%CVE-2026-78437HIGHApache Tomcat: HTTP/2 DoS via malformed requestEPSS 0.5%