Fallos del tipo CWE-459

158 resultados

Limpeza Incompleta de Recursos

Ocorre quando uma aplicação não libera completamente recursos (memória, arquivos, conexões, sessões) ao encerrar um processo ou função, deixando dados sensíveis ou ocupação residual no sistema. Isso pode levar a vazamento de memória, exposição de informações confidenciais ou degradação de desempenho.

Ejemplo

Uma função abre uma conexão com banco de dados dentro de um bloco try-catch, mas se uma exceção é lançada, a conexão nunca é fechada. Ou um arquivo temporário contendo credenciais é deletado, mas o buffer em memória não é zerado, permitindo recuperação forense.

Cómo mitigar

Use padrões como try-with-resources (Java), context managers (Python), ou defer (Go) para garantir limpeza automática. Implemente finally blocks explícitos, zero-out buffers com dados sensíveis e valide que todos os recursos foram liberados em testes de integração.

CVE-2019-5011HIGHAn exploitable privilege escalation vulnerability exists in the helper service CleanMyMac X, version 4.20, due to improper updating. The appEPSS 0.4%CVE-2026-33232HIGHAutoGPT: Unauthenticated DoS via Disk Space ExhaustionEPSS 0.4%CVE-2021-4032—A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected.EPSS 0.4%CVE-2026-109276MEDIUMImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG DecoderEPSS 0.4%CVE-2026-113073HIGHIncomplete cleanup in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTEPSS 0.4%CVE-2025-66467HIGHApache CloudStack: MinIO policy remains intact on bucket deletionEPSS 0.4%CVE-2026-5038MEDIUMmulter vulnerable to Denial of Service via incomplete cleanup of aborted uploadsEPSS 0.4%CVE-2026-87549MEDIUMIncomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass syEPSS 0.4%CVE-2020-10685MEDIUMA flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as wEPSS 0.4%CVE-2022-0646—A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancelEPSS 0.4%CVE-2026-113010MEDIUMIncomplete cleanup in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process EPSS 0.4%CVE-2026-106203HIGHIncomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to EPSS 0.4%CVE-2025-15331MEDIUMTanium addressed an uncontrolled resource consumption vulnerability in Connect.EPSS 0.4%CVE-2026-82236LOWFile Browser 2.63.6 through 2.63.23 Share Link Exposure via File DeletionEPSS 0.4%CVE-2025-59781HIGHBIG-IP DNS cache vulnerabilityEPSS 0.3%CVE-2026-109869HIGHundici vulnerable to Denial of Service via unhandled error on excessive content-encodingsEPSS 0.3%CVE-2026-112180MEDIUMMISP Incomplete Event Deletion Leaves Orphaned Sensitive RecordsEPSS 0.3%CVE-2026-67442LOWFUXA Business Logic Flaw: Role Deletion Without User Assignment CleanupEPSS 0.3%CVE-2026-115478HIGHobsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changesEPSS 0.3%CVE-2026-67334MEDIUMbetter-auth Stale Sessions Persist After User DeletionEPSS 0.3%