Falhas do tipo CWE-459

159 resultados

Limpeza incompleta de recursos

Ocorre quando uma aplicação não libera ou reseta adequadamente recursos (memória, arquivos, conexões, dados sensíveis) após seu uso, deixando-os em estado inconsistente ou acessível. Isso pode levar a vazamento de memória, exposição de dados confidenciais ou comportamento impredizível do sistema.

Exemplo

Uma função abre uma conexão de banco de dados dentro de um bloco try, mas se uma exceção for lançada antes do close(), a conexão permanece aberta indefinidamente. Ou um array com dados de senha é preenchido, usado, mas nunca zerado na memória antes de ser descartado, permitindo recuperação via análise de dump.

Como mitigar

Use padrões de garantia de limpeza: em Java use try-with-resources ou finally; em Python use context managers (with); sempre feche recursos explicitamente. Para dados sensíveis, sobrescreva buffers com zeros ou valores aleatórios antes de liberar. Implemente testes que validem que recursos foram efetivamente liberados após exceções.

CVE-2019-5011HIGHAn exploitable privilege escalation vulnerability exists in the helper service CleanMyMac X, version 4.20, due to improper updating. The appEPSS 0.4%CVE-2026-33232HIGHAutoGPT: Unauthenticated DoS via Disk Space ExhaustionEPSS 0.4%CVE-2021-4032—A vulnerability was found in the Linux kernel's KVM subsystem in arch/x86/kvm/lapic.c kvm_free_lapic when a failure allocation was detected.EPSS 0.4%CVE-2026-109276MEDIUMImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG DecoderEPSS 0.4%CVE-2026-113073HIGHIncomplete cleanup in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTEPSS 0.4%CVE-2025-66467HIGHApache CloudStack: MinIO policy remains intact on bucket deletionEPSS 0.4%CVE-2026-5038MEDIUMmulter vulnerable to Denial of Service via incomplete cleanup of aborted uploadsEPSS 0.4%CVE-2026-87549MEDIUMIncomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass syEPSS 0.4%CVE-2020-10685MEDIUMA flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as wEPSS 0.4%CVE-2022-0646—A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancelEPSS 0.4%CVE-2026-113010MEDIUMIncomplete cleanup in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process EPSS 0.4%CVE-2025-15331MEDIUMTanium addressed an uncontrolled resource consumption vulnerability in Connect.EPSS 0.4%CVE-2026-106203HIGHIncomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to EPSS 0.4%CVE-2026-82236LOWFile Browser 2.63.6 through 2.63.23 Share Link Exposure via File DeletionEPSS 0.4%CVE-2025-59781HIGHBIG-IP DNS cache vulnerabilityEPSS 0.3%CVE-2026-109869HIGHundici vulnerable to Denial of Service via unhandled error on excessive content-encodingsEPSS 0.3%CVE-2026-123560HIGHZebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block BodyEPSS 0.3%CVE-2026-112180MEDIUMMISP Incomplete Event Deletion Leaves Orphaned Sensitive RecordsEPSS 0.3%CVE-2026-67442LOWFUXA Business Logic Flaw: Role Deletion Without User Assignment CleanupEPSS 0.3%CVE-2026-67334MEDIUMbetter-auth Stale Sessions Persist After User DeletionEPSS 0.3%