Weaknesses of type CWE-459

158 results

Limpeza incompleta de recursos

Ocorre quando o software falha em liberar ou limpar completamente recursos (memória, arquivos abertos, conexões de rede, dados sensíveis em memória) antes de encerrar um processo ou função. Isso permite vazamento de dados sensíveis, consumo não controlado de recursos ou comportamentos inesperados em estados posteriores do programa.

Example

Uma aplicação autentica um usuário, armazena a senha em uma variável de buffer, mas encerra a sessão sem sobrescrever o buffer com zeros. Um atacante com acesso à memória pode recuperar a senha ainda presente. Ou um arquivo temporário com dados confidenciais não é deletado após o uso, ficando acessível no disco.

How to mitigate

Implemente handlers de limpeza explícitos (finally, destructores, context managers em Python) que garantam liberação de recursos mesmo em casos de erro. Para dados sensíveis, sobrescreva com zeros antes de liberar memória. Use ferramentas de análise estática e testes de vazamento de memória (valgrind, AddressSanitizer) para detectar limpezas incompletas.

CVE-2026-121096—Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium secuEPSS 0.2%CVE-2022-45455MEDIUMLocal privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office EPSS 0.1%CVE-2026-28196LOWIn JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on diskEPSS 0.1%CVE-2026-121750LOWnvm install --offline installs a cached tarball that previously failed checksum verificationEPSS 0.1%CVE-2026-17525MEDIUMMy Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversionEPSS 0.1%CVE-2026-35361LOWuutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux SystemsEPSS 0.1%CVE-2026-19730MEDIUMPodman: podman: quadlet install --replace non-truncating write retains removed host-access directivesEPSS 0.1%CVE-2026-107914HIGHBackdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archiEPSS 0.1%CVE-2025-29934MEDIUMA bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resultiEPSS 0.1%CVE-2026-6830MEDIUMNesquena Hermes WebUI Environment Variable Credential Leakage via Profile SwitchEPSS 0.1%CVE-2026-0427MEDIUMImproper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual machine (VM) to EPSS 0.1%CVE-2024-45445MEDIUMVulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this vulnerability will afEPSS 0.1%CVE-2026-106243MEDIUMIncomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crEPSS 0.1%CVE-2026-107332MEDIUMInsecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio CodeEPSS 0.1%CVE-2026-19740MEDIUMBluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedureEPSS 0.1%CVE-2026-19739MEDIUMBluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection UpdateEPSS 0.1%CVE-2026-110008MEDIUM@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callbackEPSS 0.1%CVE-2023-20518LOWIncomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BIOS menu or UEFI shellEPSS 0.1%