Falhas do tipo CWE-459

159 resultados

Limpeza incompleta de recursos

Ocorre quando uma aplicação não libera ou reseta adequadamente recursos (memória, arquivos, conexões, dados sensíveis) após seu uso, deixando-os em estado inconsistente ou acessível. Isso pode levar a vazamento de memória, exposição de dados confidenciais ou comportamento impredizível do sistema.

Exemplo

Uma função abre uma conexão de banco de dados dentro de um bloco try, mas se uma exceção for lançada antes do close(), a conexão permanece aberta indefinidamente. Ou um array com dados de senha é preenchido, usado, mas nunca zerado na memória antes de ser descartado, permitindo recuperação via análise de dump.

Como mitigar

Use padrões de garantia de limpeza: em Java use try-with-resources ou finally; em Python use context managers (with); sempre feche recursos explicitamente. Para dados sensíveis, sobrescreva buffers com zeros ou valores aleatórios antes de liberar. Implemente testes que validem que recursos foram efetivamente liberados após exceções.

CVE-2024-50385MEDIUMA denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A speEPSS 0.8%CVE-2025-0726HIGHEclipse ThreadX NetX Duo HTTP server denial of serviceEPSS 0.8%CVE-2026-28268CRITICALVikunja Vulnerable to Account Takeover via Password Reset Token ReuseEPSS 0.7%CVE-2026-3304HIGHMulter vulnerable to Denial of Service via incomplete cleanupEPSS 0.7%CVE-2022-39368HIGHCalifornium Failing DTLS handshakes causes Data Loss due to throttling blocking processing of recordsEPSS 0.7%CVE-2023-20862MEDIUMIn Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support doesEPSS 0.6%CVE-2025-21609HIGHSiYuan has an arbitrary file deletion vulnerabilityEPSS 0.6%CVE-2024-26005MEDIUMPHOENIX CONTACT: Privilege gain through incomplete cleanup in CHARX SeriesEPSS 0.6%CVE-2026-113658HIGHApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryEPSS 0.6%CVE-2026-52736HIGHZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cacheEPSS 0.6%CVE-2026-34263CRITICALMissing authentication check in SAP Commerce cloud configurationEPSS 0.6%CVE-2026-42492HIGHvIRQ event channel binding may break XenstoreEPSS 0.6%CVE-2026-77761MEDIUMCross-Document Parser State Contamination in misp-stixEPSS 0.6%CVE-2025-66675HIGHApache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixedEPSS 0.6%CVE-2026-93446HIGHApache Tomcat: Possible TLS 1.3 connection failuresEPSS 0.6%CVE-2022-44546HIGHThe kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation EPSS 0.6%CVE-2026-88932MEDIUMmulter vulnerable to Denial of Service via orphaned disk writes on aborted uploadsEPSS 0.5%CVE-2021-4002—A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmgetEPSS 0.5%CVE-2026-88041HIGHApache Tomcat: HTTP/2 trailer header cross-contaminationEPSS 0.5%CVE-2026-78437HIGHApache Tomcat: HTTP/2 DoS via malformed requestEPSS 0.5%