Weaknesses of type CWE-459

114 results

Limpeza incompleta de recursos

Ocorre quando o software falha em liberar ou limpar completamente recursos (memória, arquivos abertos, conexões de rede, dados sensíveis em memória) antes de encerrar um processo ou função. Isso permite vazamento de dados sensíveis, consumo não controlado de recursos ou comportamentos inesperados em estados posteriores do programa.

Example

Uma aplicação autentica um usuário, armazena a senha em uma variável de buffer, mas encerra a sessão sem sobrescrever o buffer com zeros. Um atacante com acesso à memória pode recuperar a senha ainda presente. Ou um arquivo temporário com dados confidenciais não é deletado após o uso, ficando acessível no disco.

How to mitigate

Implemente handlers de limpeza explícitos (finally, destructores, context managers em Python) que garantam liberação de recursos mesmo em casos de erro. Para dados sensíveis, sobrescreva com zeros antes de liberar memória. Use ferramentas de análise estática e testes de vazamento de memória (valgrind, AddressSanitizer) para detectar limpezas incompletas.

CVE-2026-19019MEDIUMpoco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanupEPSS 0.3%CVE-2026-67442LOWFUXA Business Logic Flaw: Role Deletion Without User Assignment CleanupEPSS 0.3%CVE-2022-0171—A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to cEPSS 0.3%CVE-2026-79265MEDIUMIncomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procesEPSS 0.3%CVE-2024-6300LOWIncomplete Cleanup in ConduitEPSS 0.3%CVE-2024-21617MEDIUMJunos OS: BGP flap on NSR-enabled devices causes memory leakEPSS 0.3%CVE-2026-82236LOWFile Browser 2.63.6 through 2.63.23 Share Link Exposure via File DeletionEPSS 0.3%CVE-2026-5038MEDIUMmulter vulnerable to Denial of Service via incomplete cleanup of aborted uploadsEPSS 0.3%CVE-2026-19474HIGH@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted uploadEPSS 0.3%CVE-2026-68809MEDIUMPowerpoint Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-60730HIGHPerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme functionEPSS 0.3%CVE-2026-78947MEDIUMIncomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass webEPSS 0.3%CVE-2024-1048LOWGrub2: grub2-set-bootflag can be abused by local (pseudo-)usersEPSS 0.3%CVE-2026-78903LOWIncomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proceEPSS 0.3%CVE-2022-27639MEDIUMIncomplete cleanup in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentialEPSS 0.3%CVE-2026-91730LOWIncomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer procesEPSS 0.2%CVE-2025-55910MEDIUMCMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.EPSS 0.2%CVE-2023-45846MEDIUMIncomplete cleanup in Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable denial of EPSS 0.2%CVE-2022-3238HIGHA double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneously. This flaw allowEPSS 0.2%CVE-2022-43477LOWIncomplete cleanup for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local accEPSS 0.2%