Weaknesses of type CWE-459

114 results

Limpeza incompleta de recursos

Ocorre quando o software falha em liberar ou limpar completamente recursos (memória, arquivos abertos, conexões de rede, dados sensíveis em memória) antes de encerrar um processo ou função. Isso permite vazamento de dados sensíveis, consumo não controlado de recursos ou comportamentos inesperados em estados posteriores do programa.

Example

Uma aplicação autentica um usuário, armazena a senha em uma variável de buffer, mas encerra a sessão sem sobrescrever o buffer com zeros. Um atacante com acesso à memória pode recuperar a senha ainda presente. Ou um arquivo temporário com dados confidenciais não é deletado após o uso, ficando acessível no disco.

How to mitigate

Implemente handlers de limpeza explícitos (finally, destructores, context managers em Python) que garantam liberação de recursos mesmo em casos de erro. Para dados sensíveis, sobrescreva com zeros antes de liberar memória. Use ferramentas de análise estática e testes de vazamento de memória (valgrind, AddressSanitizer) para detectar limpezas incompletas.

CVE-2024-50384MEDIUMA denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A speEPSS 0.8%CVE-2025-0726HIGHEclipse ThreadX NetX Duo HTTP server denial of serviceEPSS 0.8%CVE-2026-28268CRITICALVikunja Vulnerable to Account Takeover via Password Reset Token ReuseEPSS 0.7%CVE-2026-3304HIGHMulter vulnerable to Denial of Service via incomplete cleanupEPSS 0.7%CVE-2023-20862MEDIUMIn Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support doesEPSS 0.6%CVE-2024-26005MEDIUMPHOENIX CONTACT: Privilege gain through incomplete cleanup in CHARX SeriesEPSS 0.6%CVE-2026-34263CRITICALMissing authentication check in SAP Commerce cloud configurationEPSS 0.6%CVE-2025-21609HIGHSiYuan has an arbitrary file deletion vulnerabilityEPSS 0.6%CVE-2022-39368HIGHCalifornium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of recordsEPSS 0.6%CVE-2025-66675HIGHApache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixedEPSS 0.6%CVE-2021-4002—A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmgetEPSS 0.5%CVE-2022-44546HIGHThe kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation EPSS 0.5%CVE-2025-0473MEDIUMIncomplete Cleanup vulnerability in PMB platformEPSS 0.5%CVE-2026-11576HIGHThe security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanEPSS 0.5%CVE-2026-42492HIGHvIRQ event channel binding may break XenstoreEPSS 0.5%CVE-2024-28265CRITICALIBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.EPSS 0.5%CVE-2026-52736HIGHZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cacheEPSS 0.4%CVE-2023-2400LOWImproper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view useEPSS 0.4%CVE-2025-6338CRITICALPossible denial of service with multiple incoming connections to a Schannel based server with a TLS backendEPSS 0.4%CVE-2024-2403MEDIUM Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attaEPSS 0.4%