Weaknesses of type CWE-459

114 results

Limpeza incompleta de recursos

Ocorre quando o software falha em liberar ou limpar completamente recursos (memória, arquivos abertos, conexões de rede, dados sensíveis em memória) antes de encerrar um processo ou função. Isso permite vazamento de dados sensíveis, consumo não controlado de recursos ou comportamentos inesperados em estados posteriores do programa.

Example

Uma aplicação autentica um usuário, armazena a senha em uma variável de buffer, mas encerra a sessão sem sobrescrever o buffer com zeros. Um atacante com acesso à memória pode recuperar a senha ainda presente. Ou um arquivo temporário com dados confidenciais não é deletado após o uso, ficando acessível no disco.

How to mitigate

Implemente handlers de limpeza explícitos (finally, destructores, context managers em Python) que garantam liberação de recursos mesmo em casos de erro. Para dados sensíveis, sobrescreva com zeros antes de liberar memória. Use ferramentas de análise estática e testes de vazamento de memória (valgrind, AddressSanitizer) para detectar limpezas incompletas.

CVE-2019-5011HIGHAn exploitable privilege escalation vulnerability exists in the helper service CleanMyMac X, version 4.20, due to improper updating. The appEPSS 0.4%CVE-2026-33232HIGHAutoGPT: Unauthenticated DoS via Disk Space ExhaustionEPSS 0.4%CVE-2021-4032—A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected.EPSS 0.4%CVE-2026-21438MEDIUMwebtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams MapEPSS 0.4%CVE-2020-10685MEDIUMA flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as wEPSS 0.4%CVE-2025-66467HIGHApache CloudStack: MinIO policy remains intact on bucket deletionEPSS 0.4%CVE-2026-77761MEDIUMCross-Document Parser State Contamination in misp-stixEPSS 0.4%CVE-2026-87776HIGHcompression vulnerable to Denial of Service via memory leak on premature response closeEPSS 0.4%CVE-2022-0646—A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancelEPSS 0.4%CVE-2025-59781HIGHBIG-IP DNS cache vulnerabilityEPSS 0.3%CVE-2026-77037HIGHmulter vulnerable to Denial of Service via file descriptor leak on aborted uploadsEPSS 0.3%CVE-2026-52733MEDIUMZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tipEPSS 0.3%CVE-2025-15331MEDIUMTanium addressed an uncontrolled resource consumption vulnerability in Connect.EPSS 0.3%CVE-2026-87436MEDIUMIncomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web EPSS 0.3%CVE-2026-87446MEDIUMIncomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sEPSS 0.3%CVE-2026-85043CRITICALIncomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via craEPSS 0.3%CVE-2026-87549MEDIUMIncomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass syEPSS 0.3%CVE-2024-20303HIGHA vulnerability in the multicast DNS (mDNS) gateway feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauEPSS 0.3%CVE-2026-88932MEDIUMmulter vulnerable to Denial of Service via orphaned disk writes on aborted uploadsEPSS 0.3%CVE-2023-22407MEDIUMJunos OS and Junos OS Evolved: An RPD crash can happen due to an MPLS TE tunnel configuration change on a directly connected routerEPSS 0.3%