Fallos del tipo CWE-459

158 resultados

Limpeza Incompleta de Recursos

Ocorre quando uma aplicação não libera completamente recursos (memória, arquivos, conexões, sessões) ao encerrar um processo ou função, deixando dados sensíveis ou ocupação residual no sistema. Isso pode levar a vazamento de memória, exposição de informações confidenciais ou degradação de desempenho.

Ejemplo

Uma função abre uma conexão com banco de dados dentro de um bloco try-catch, mas se uma exceção é lançada, a conexão nunca é fechada. Ou um arquivo temporário contendo credenciais é deletado, mas o buffer em memória não é zerado, permitindo recuperação forense.

Cómo mitigar

Use padrões como try-with-resources (Java), context managers (Python), ou defer (Go) para garantir limpeza automática. Implemente finally blocks explícitos, zero-out buffers com dados sensíveis e valide que todos os recursos foram liberados em testes de integração.

CVE-2024-20303HIGHA vulnerability in the multicast DNS (mDNS) gateway feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauEPSS 0.3%CVE-2026-95326HIGHIncomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass syEPSS 0.3%CVE-2026-113050MEDIUMIncomplete cleanup in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and levEPSS 0.3%CVE-2023-22407MEDIUMJunos OS and Junos OS Evolved: An RPD crash can happen due to an MPLS TE tunnel configuration change on a directly connected routerEPSS 0.3%CVE-2026-121204HIGHIncomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HEPSS 0.3%CVE-2026-78947MEDIUMIncomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass webEPSS 0.3%CVE-2026-87446MEDIUMIncomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sEPSS 0.3%CVE-2026-106294CRITICALIncomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restricEPSS 0.3%CVE-2026-87436MEDIUMIncomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web EPSS 0.3%CVE-2026-104427HIGHZebra before 6.1.0 Chain Stall via Stale parent_error_map EntryEPSS 0.3%CVE-2026-79265MEDIUMIncomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procesEPSS 0.3%CVE-2026-104421MEDIUMZebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes LockoutEPSS 0.3%CVE-2026-101100MEDIUMag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanupEPSS 0.3%CVE-2022-0171—A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to cEPSS 0.3%CVE-2026-49484MEDIUMCode for IBM i: Temporary files are visible to all usersEPSS 0.3%CVE-2026-78903LOWIncomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proceEPSS 0.3%CVE-2025-60730HIGHPerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme functionEPSS 0.3%CVE-2024-6300LOWIncomplete Cleanup in ConduitEPSS 0.3%CVE-2024-21617MEDIUMJunos OS: BGP flap on NSR-enabled devices causes memory leakEPSS 0.3%CVE-2026-78600LOWIncomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential RetentionEPSS 0.3%