Fallos del tipo CWE-459

158 resultados

Limpeza Incompleta de Recursos

Ocorre quando uma aplicação não libera completamente recursos (memória, arquivos, conexões, sessões) ao encerrar um processo ou função, deixando dados sensíveis ou ocupação residual no sistema. Isso pode levar a vazamento de memória, exposição de informações confidenciais ou degradação de desempenho.

Ejemplo

Uma função abre uma conexão com banco de dados dentro de um bloco try-catch, mas se uma exceção é lançada, a conexão nunca é fechada. Ou um arquivo temporário contendo credenciais é deletado, mas o buffer em memória não é zerado, permitindo recuperação forense.

Cómo mitigar

Use padrões como try-with-resources (Java), context managers (Python), ou defer (Go) para garantir limpeza automática. Implemente finally blocks explícitos, zero-out buffers com dados sensíveis e valide que todos os recursos foram liberados em testes de integração.

CVE-2024-50385MEDIUMA denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A speEPSS 0.8%CVE-2025-0726HIGHEclipse ThreadX NetX Duo HTTP server denial of serviceEPSS 0.8%CVE-2026-28268CRITICALVikunja Vulnerable to Account Takeover via Password Reset Token ReuseEPSS 0.7%CVE-2026-3304HIGHMulter vulnerable to Denial of Service via incomplete cleanupEPSS 0.7%CVE-2022-39368HIGHCalifornium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of recordsEPSS 0.7%CVE-2023-20862MEDIUMIn Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support doesEPSS 0.6%CVE-2025-21609HIGHSiYuan has an arbitrary file deletion vulnerabilityEPSS 0.6%CVE-2024-26005MEDIUMPHOENIX CONTACT: Privilege gain through incomplete cleanup in CHARX SeriesEPSS 0.6%CVE-2026-113658HIGHApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryEPSS 0.6%CVE-2026-34263CRITICALMissing authentication check in SAP Commerce cloud configurationEPSS 0.6%CVE-2026-52736HIGHZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cacheEPSS 0.6%CVE-2026-77761MEDIUMCross-Document Parser State Contamination in misp-stixEPSS 0.6%CVE-2026-42492HIGHvIRQ event channel binding may break XenstoreEPSS 0.6%CVE-2025-66675HIGHApache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixedEPSS 0.6%CVE-2026-93446HIGHApache Tomcat: Possible TLS 1.3 connection failuresEPSS 0.6%CVE-2022-44546HIGHThe kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation EPSS 0.6%CVE-2026-88932MEDIUMmulter vulnerable to Denial of Service via orphaned disk writes on aborted uploadsEPSS 0.5%CVE-2021-4002—A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmgetEPSS 0.5%CVE-2026-88041HIGHApache Tomcat: HTTP/2 trailer header cross-contaminationEPSS 0.5%CVE-2026-78437HIGHApache Tomcat: HTTP/2 DoS via malformed requestEPSS 0.5%