Weaknesses of type CWE-459

158 results

Limpeza incompleta de recursos

Ocorre quando o software falha em liberar ou limpar completamente recursos (memória, arquivos abertos, conexões de rede, dados sensíveis em memória) antes de encerrar um processo ou função. Isso permite vazamento de dados sensíveis, consumo não controlado de recursos ou comportamentos inesperados em estados posteriores do programa.

Example

Uma aplicação autentica um usuário, armazena a senha em uma variável de buffer, mas encerra a sessão sem sobrescrever o buffer com zeros. Um atacante com acesso à memória pode recuperar a senha ainda presente. Ou um arquivo temporário com dados confidenciais não é deletado após o uso, ficando acessível no disco.

How to mitigate

Implemente handlers de limpeza explícitos (finally, destructores, context managers em Python) que garantam liberação de recursos mesmo em casos de erro. Para dados sensíveis, sobrescreva com zeros antes de liberar memória. Use ferramentas de análise estática e testes de vazamento de memória (valgrind, AddressSanitizer) para detectar limpezas incompletas.

CVE-2026-103937HIGHMisskey: Denial of service resulting from insufficient cleanup processing during file uploadsEPSS 0.5%CVE-2026-19474HIGH@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted uploadEPSS 0.5%CVE-2026-19019MEDIUMpoco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanupEPSS 0.5%CVE-2026-113012HIGHIncomplete cleanup in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execEPSS 0.5%CVE-2026-87776HIGHcompression vulnerable to Denial of Service via memory leak on premature response closeEPSS 0.5%CVE-2025-0473MEDIUMIncomplete Cleanup vulnerability in PMB platformEPSS 0.5%CVE-2026-102030HIGHJunos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is usedEPSS 0.5%CVE-2026-11576HIGHThe security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanEPSS 0.5%CVE-2024-28265CRITICALIBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.EPSS 0.5%CVE-2026-113168HIGHIncomplete cleanup in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass EPSS 0.5%CVE-2026-77037HIGHmulter vulnerable to Denial of Service via file descriptor leak on aborted uploadsEPSS 0.5%CVE-2026-31668CRITICALseg6: separate dst_cache for input and output paths in seg6 lwtunnelEPSS 0.4%CVE-2023-2400LOWImproper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view useEPSS 0.4%CVE-2026-85043CRITICALIncomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via craEPSS 0.4%CVE-2026-52733MEDIUMZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tipEPSS 0.4%CVE-2026-68809MEDIUMPowerpoint Information Disclosure VulnerabilityEPSS 0.4%CVE-2025-6338CRITICALPossible denial of service with multiple incoming connections to a Schannel based server with a TLS backendEPSS 0.4%CVE-2024-2403MEDIUM Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attaEPSS 0.4%CVE-2026-21438MEDIUMwebtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams MapEPSS 0.4%CVE-2026-106375CRITICALIncomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside tEPSS 0.4%