Falhas do tipo CWE-459

159 resultados

Limpeza incompleta de recursos

Ocorre quando uma aplicação não libera ou reseta adequadamente recursos (memória, arquivos, conexões, dados sensíveis) após seu uso, deixando-os em estado inconsistente ou acessível. Isso pode levar a vazamento de memória, exposição de dados confidenciais ou comportamento impredizível do sistema.

Exemplo

Uma função abre uma conexão de banco de dados dentro de um bloco try, mas se uma exceção for lançada antes do close(), a conexão permanece aberta indefinidamente. Ou um array com dados de senha é preenchido, usado, mas nunca zerado na memória antes de ser descartado, permitindo recuperação via análise de dump.

Como mitigar

Use padrões de garantia de limpeza: em Java use try-with-resources ou finally; em Python use context managers (with); sempre feche recursos explicitamente. Para dados sensíveis, sobrescreva buffers com zeros ou valores aleatórios antes de liberar. Implemente testes que validem que recursos foram efetivamente liberados após exceções.

CVE-2026-115478HIGHobsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changesEPSS 0.3%CVE-2024-20303HIGHA vulnerability in the multicast DNS (mDNS) gateway feature of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauEPSS 0.3%CVE-2026-95326HIGHIncomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass syEPSS 0.3%CVE-2026-113050MEDIUMIncomplete cleanup in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and levEPSS 0.3%CVE-2023-22407MEDIUMJunos OS and Junos OS Evolved: An RPD crash can happen due to an MPLS TE tunnel configuration change on a directly connected routerEPSS 0.3%CVE-2026-121204HIGHIncomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HEPSS 0.3%CVE-2026-87436MEDIUMIncomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web EPSS 0.3%CVE-2026-106294CRITICALIncomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restricEPSS 0.3%CVE-2026-78947MEDIUMIncomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass webEPSS 0.3%CVE-2026-87446MEDIUMIncomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sEPSS 0.3%CVE-2026-104427HIGHZebra before 6.1.0 Chain Stall via Stale parent_error_map EntryEPSS 0.3%CVE-2026-79265MEDIUMIncomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procesEPSS 0.3%CVE-2026-104421MEDIUMZebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes LockoutEPSS 0.3%CVE-2026-101100MEDIUMag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanupEPSS 0.3%CVE-2022-0171—A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to cEPSS 0.3%CVE-2026-49484MEDIUMCode for IBM i: Temporary files are visible to all usersEPSS 0.3%CVE-2026-78903LOWIncomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proceEPSS 0.3%CVE-2025-60730HIGHPerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme functionEPSS 0.3%CVE-2024-6300LOWIncomplete Cleanup in ConduitEPSS 0.3%CVE-2024-21617MEDIUMJunos OS: BGP flap on NSR-enabled devices causes memory leakEPSS 0.3%