Fallos del tipo CWE-459

86 resultados

Limpeza Incompleta de Recursos

Ocorre quando uma aplicação não libera completamente recursos (memória, arquivos, conexões, sessões) ao encerrar um processo ou função, deixando dados sensíveis ou ocupação residual no sistema. Isso pode levar a vazamento de memória, exposição de informações confidenciais ou degradação de desempenho.

Ejemplo

Uma função abre uma conexão com banco de dados dentro de um bloco try-catch, mas se uma exceção é lançada, a conexão nunca é fechada. Ou um arquivo temporário contendo credenciais é deletado, mas o buffer em memória não é zerado, permitindo recuperação forense.

Cómo mitigar

Use padrões como try-with-resources (Java), context managers (Python), ou defer (Go) para garantir limpeza automática. Implemente finally blocks explícitos, zero-out buffers com dados sensíveis e valide que todos os recursos foram liberados em testes de integração.

CVE-2025-31650HIGHApache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frameEPSS 59.9%CVE-2022-1552—A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another usEPSS 12.5%CVE-2022-21125MEDIUMIncomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable infoEPSS 6.5%CVE-2023-41835HIGHApache Struts: excessive disk usageEPSS 6.3%CVE-2022-21123MEDIUMIncomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable informatiEPSS 6.2%CVE-2022-21166MEDIUMIncomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentiallyEPSS 5.8%CVE-2022-21127MEDIUMIncomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially EPSS 5.5%CVE-2022-1473HIGHResource leakage when decoding certificates and keysEPSS 2.5%CVE-2024-23672MEDIUMApache Tomcat: WebSocket DoS with incomplete closing handshakeEPSS 2.3%CVE-2023-42795MEDIUMApache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requestsEPSS 2.2%CVE-2023-42794—Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on WindowsEPSS 1.9%CVE-2023-36468CRITICALUpgrading doesn't prevent exploiting vulnerable XWiki documentsEPSS 1.8%CVE-2025-64775HIGHApache Struts: File leak in multipart request processing causes disk exhaustion (DoS)EPSS 1.5%CVE-2022-45347CRITICALApache ShardingSphere-Proxy: MySQL authentication bypassEPSS 1.4%CVE-2021-32928—The Sentinel LDK Run-Time Environment installer (Versions 7.6 and prior) adds a firewall rule named “Sentinel License Manager” that allows iEPSS 1.3%CVE-2023-0836HIGHAn information leak vulnerability was discovered in HAProxy 2.1, 2.2 before 2.2.27, 2.3, 2.4 before 2.4.21, 2.5 before 2.5.11, 2.6 before 2.EPSS 1.2%CVE-2020-12494MEDIUMBeckhoff: Etherleak in TwinCAT RT network driverEPSS 1.0%CVE-2021-36205HIGHMetasys session tokenEPSS 1.0%CVE-2025-2260HIGHEclipse ThreadX NetX Duo HTTP component server denial of serviceEPSS 0.9%CVE-2025-0726HIGHEclipse ThreadX NetX Duo HTTP server denial of serviceEPSS 0.7%